AZ-305 Design identity, governance, and monitoring solutions Practice Test 10 — 15 Questions

Question 1

You are designing an identity solution for a large enterprise that uses Microsoft Entra ID. The company has a partner organization that needs access to a specific application. The partner uses their own identity provider (IdP). You need to enable seamless access without duplicating user accounts. What should you configure?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD B2B) is the correct solution because it allows the partner organization to access the specific application using their own identity provider (IdP) without requiring duplicate user accounts in your tenant. It leverages federation trust, enabling seamless single sign-on (SSO) by authenticating users against their home IdP and issuing a token for your application. This aligns with the requirement for a zero-trust, external identity scenario where user lifecycle is managed externally.

Answer

Federation with the partner's IdP

Answer

Passwordless authentication

Answer

Identity synchronization

Question 2

Your Azure subscription contains multiple virtual machines (VMs) that run a line-of-business application. You need to configure alerts when the CPU usage exceeds 90% for more than 5 minutes. Additionally, the alert must automatically trigger a runbook to scale out the application. Which Azure service should you use to create this alert?

Accepted Answer

Azure Monitor metric alert. Azure Monitor metric alerts can evaluate resource metrics like CPU usage at a specified frequency and trigger actions when a threshold (e.g., 90%) is breached for a given duration (e.g., 5 minutes). The alert can invoke an Automation runbook via an action group, enabling automatic scaling of the application. This is the correct service because it directly supports metric-based alerting with multi-condition evaluation and action group integration.

Answer

Azure Automation

Answer

Azure Logic Apps

Answer

Azure Autoscale

Question 3

Which TWO of the following are true about Microsoft Entra ID Governance features?

Accepted Answer

Access reviews allow administrators to periodically review and attest to access rights.. Option B is correct because Microsoft Entra ID Access Reviews enable administrators to periodically review and attest to the access rights of users, groups, or applications, ensuring that only authorized users retain access. This is a core governance feature that helps organizations meet compliance and security requirements by automating the certification process.

Answer

Conditional Access policies govern access based on location and device.

Answer

Privileged Identity Management (PIM) provides just-in-time access for all users.

Answer

Identity Protection automatically blocks all risky sign-ins.

Question 4

Which TWO of the following are valid Azure Policy effects that can be used to enforce compliance?

Accepted Answer

DeployIfNotExists. DeployIfNotExists is a valid Azure Policy effect that evaluates resources after creation and deploys a template to remediate non-compliant resources, such as automatically installing the Log Analytics agent on VMs missing it. This effect enforces compliance by actively deploying resources to meet policy rules, making it correct for this question.

Answer

Deny

Answer

AuditIfNotExists

Answer

AutoRemediate

Question 5

Which THREE of the following are required to collect Windows security events into Microsoft Sentinel?

Accepted Answer

Log Analytics workspace. A Log Analytics workspace is required because Microsoft Sentinel is built on top of it; all security events collected by Sentinel are stored in the workspace's tables, and Sentinel uses the workspace as its data repository for analytics, alerting, and investigation.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 6

Refer to the exhibit. You apply this Azure Policy to a subscription. What happens when a user tries to create a virtual machine?

Accepted Answer

The creation of the virtual machine is denied.. The Azure Policy in the exhibit uses the 'deny' effect, which explicitly blocks any operation that does not comply with the policy rule. When a user attempts to create a virtual machine, Azure Resource Manager evaluates the policy before provisioning the resource. If the VM creation request does not meet the conditions defined in the policy (e.g., requiring a specific tag or location), the request is denied and the VM is not created. This is why option C is correct.

Answer

The virtual machine is created, and an audit event is logged.

Answer

The virtual machine is created only if it has a specific tag.

Answer

The virtual machine is created only in a specific location.

Question 7

Refer to the exhibit. You create this Conditional Access policy in Microsoft Entra ID. What is the result?

Accepted Answer

All users are prompted for MFA when accessing any application from a browser or mobile app.. The exhibit shows a Conditional Access policy that applies to 'All users' and targets 'All cloud apps' with the grant control set to 'Require multi-factor authentication'. This configuration forces every user, including administrators and external users, to complete MFA when accessing any cloud application from any platform (browser or mobile app). Option B correctly states this universal MFA requirement.

Answer

Only administrators are prompted for MFA.

Answer

External users are prompted for MFA.

Answer

Access is blocked for all users.

Question 8

Refer to the exhibit. You run this Kusto query in Azure Monitor Logs. What does it return?

Accepted Answer

Computers that have not sent a heartbeat in the last 5 minutes.. The query uses the `Heartbeat` table and filters for heartbeats older than 5 minutes (`ago(5m)`). The `where` clause selects records where `TimeGenerated` is less than 5 minutes ago, meaning it finds heartbeats that were sent before that threshold. The `distinct Computer` then returns only computers whose most recent heartbeat is older than 5 minutes, i.e., computers that have not sent a heartbeat in the last 5 minutes. This is a common pattern for detecting unresponsive or offline machines.

Answer

The number of heartbeats per computer in the last hour.

Answer

Computers that sent a heartbeat in the last 5 minutes.

Answer

The average heartbeat frequency per computer.

Question 9

Your company is designing a governance strategy for Azure resources. The security team requires that all resource groups in the production subscription must have a specific tag (Environment=Production) applied automatically. Any resource group created without this tag must be reported within 24 hours. Which Azure policy should you implement?

Accepted Answer

Create a policy with effect 'deny' on the missing tag condition.. Option C is correct because the 'deny' effect prevents the creation of any resource group that does not include the required tag, enforcing compliance at the point of creation. The requirement to report non-compliant resource groups within 24 hours is satisfied by Azure Policy's built-in compliance evaluation, which automatically marks denied requests as non-compliant and surfaces them in the compliance dashboard. This approach ensures that no resource group can be created without the tag, eliminating the need for a separate reporting mechanism.

Answer

Create a policy with effect 'audit' to report non-compliant resource groups.

Answer

Create a policy with effect 'append' to add the missing tag automatically.

Answer

Create a policy with effect 'modify' to add the tag using a managed identity.

Question 10

You are designing a monitoring solution for a critical application hosted on Azure Virtual Machines. The application is latency-sensitive and you need to be alerted when CPU usage exceeds 90% for more than 5 minutes. Which Azure Monitor feature should you use?

Accepted Answer

Metric alert. Metric alerts in Azure Monitor evaluate resource metrics (like CPU percentage) at regular intervals and trigger actions when a threshold is breached for a specified duration. Since the question involves a latency-sensitive application and a numeric threshold (CPU > 90% for 5 minutes), a metric alert is the correct choice because it provides near-real-time, low-latency evaluation directly from the VM's performance counters.

Answer

Service health alert

Answer

Log alert

Answer

Activity log alert

Question 11

Your company uses Microsoft Entra ID (formerly Azure AD) and requires that all external guest users must be automatically reviewed for access every 90 days. The review should be performed by the guest user's manager in the partner organization. However, the partner organization does not use Microsoft Entra ID. Which solution should you implement?

Accepted Answer

Configure Microsoft Entra ID access reviews to ask the guest user to self-attest their access every 90 days.. Option D is correct because Microsoft Entra ID access reviews can be configured to require guest users to self-attest their access. This is the only viable solution when the guest user's organization does not use Microsoft Entra ID, as there is no external manager identity to assign the review to. The self-attestation process allows the guest user to confirm whether they still need access, and the review can be set to recur every 90 days as required.

Answer

Create a custom Azure Logic App to send email reminders and manually track access expiration.

Answer

Configure Microsoft Entra ID access reviews to include guest users and assign the review to the guest user's external manager.

Answer

Use Azure AD B2C to manage guest identities and set up a custom review process.

Question 12

Your organization is implementing a zero-trust security model. You need to ensure that all access to corporate resources from mobile devices is conditional based on device compliance, user risk, and location. Which Microsoft Entra ID feature should you use?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID are the correct choice because they allow you to enforce access controls based on conditions such as device compliance (via integration with Microsoft Intune), user risk (via integration with Identity Protection), and location (via IP ranges or named locations). This directly supports the zero-trust principle of 'never trust, always verify' by evaluating signals before granting access to corporate resources.

Answer

Identity Protection

Answer

Microsoft Intune

Answer

Microsoft Defender XDR

Question 13

You are designing a governance strategy for a multi-subscription Azure environment. Your compliance team requires that any resource group created in the production subscription must have a specific naming convention: it must start with 'prod-' and be followed by a three-letter department code and a two-digit number. Any resource group not following this convention should be automatically prevented from creation. Which Azure policy definition should you use?

Accepted Answer

Use a policy with 'pattern' constraint on the 'name' field.. Option D is correct because Azure Policy's 'pattern' constraint uses regular expressions to enforce complex naming conventions. The requirement for resource groups to start with 'prod-', followed by a three-letter department code and a two-digit number, is a pattern that can be precisely defined with a regex like '^prod-[a-z]{3}\d{2}$'. The 'pattern' constraint is the only option that supports regex-based validation, making it suitable for this multi-part naming rule.

Answer

Use a policy with 'like' constraint on the 'name' field.

Answer

Use a policy with 'match' constraint on the 'name' field.

Answer

Use a policy with 'contains' constraint on the 'name' field.

Question 14

Your company has multiple Azure subscriptions. You need to ensure that all security-related logs from Azure resources are centralized in a single Log Analytics workspace for analysis. Which Azure service should you use to collect and route these logs?

Accepted Answer

Azure Policy. Azure Policy is correct because it can enforce the deployment of a diagnostic setting on all Azure resources, automatically routing security-related logs (such as Activity Logs, resource logs, and audit logs) to a single Log Analytics workspace. This ensures centralized collection and analysis without manual configuration per resource, meeting the requirement for a governance-driven approach.

Answer

Azure Monitor

Answer

Microsoft Sentinel

Answer

Azure Event Hubs

Question 15

Your organization uses Microsoft Entra ID and has a hybrid identity deployment with Active Directory Domain Services (AD DS) on-premises. You need to synchronize user identities to Microsoft Entra ID, but you must ensure that password hashes are never stored in the cloud. Which synchronization method should you use?

Accepted Answer

Pass-through Authentication (PTA). Pass-through Authentication (PTA) is the correct choice because it validates user passwords directly against on-premises Active Directory without ever storing password hashes in Azure AD. This meets the requirement that password hashes are never stored in the cloud, as PTA uses an agent on-premises to authenticate users, and only the validation result is sent to Azure AD.

Answer

Password Hash Sync

Answer

Federation with AD FS

Answer

Azure AD Connect Cloud Sync