AZ-305 Design identity, governance, and monitoring solutions Practice Test 11 — 15 Questions

Question 1

Which TWO actions should you take to implement a least-privilege identity strategy for Azure resources?

Accepted Answer

Use managed identities for Azure resources instead of service principals with secrets. Managed identities for Azure resources eliminate the need to manage credentials by automatically rotating them and binding them to a resource lifecycle. This removes the risk of secret leakage or mismanagement that exists with service principal secrets, directly supporting a least-privilege identity strategy by ensuring identities are scoped and ephemeral.

Answer

Assign the Contributor role at the subscription scope to allow flexibility

Answer

Use storage account keys for access to blob data

Answer

Use a single service principal for all applications

Question 2

Which THREE components are required to monitor and audit Azure resource changes using Azure Monitor?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is required because it serves as the central repository where Azure Monitor collects and stores log data from various sources, including diagnostic settings and activity logs. Without a workspace, there is no destination for the logs to be ingested, queried, or analyzed, making it an essential component for monitoring and auditing resource changes.

Answer

An Application Insights resource

Answer

Azure Policy with audit effect

Question 3

Which TWO Microsoft Entra ID features should you use to protect against credential attacks?

Accepted Answer

Password Protection. Password Protection is correct because it specifically targets credential attacks by blocking weak passwords and common variations (e.g., 'Password123!') using a global banned password list and the option to add custom terms. Identity Protection is correct because it uses real-time risk detection (e.g., leaked credentials, anonymous IP addresses) to automatically block or require MFA for suspicious sign-ins, directly mitigating credential-based attacks like password spray or brute force.

Answer

Group-based licensing

Answer

Self-Service Password Reset (SSPR)

Answer

Application Proxy

Question 4

Which THREE Azure services or features should you use to design a comprehensive monitoring solution for a hybrid infrastructure spanning on-premises and Azure?

Accepted Answer

Azure Monitor. Azure Monitor is the central platform for collecting, analyzing, and acting on telemetry from both Azure and on-premises resources. It provides a unified monitoring experience by aggregating metrics and logs, enabling alerting, dashboards, and integration with other services like Log Analytics. For a hybrid infrastructure, Azure Monitor serves as the core data ingestion and analysis hub, making it essential for a comprehensive monitoring solution.

Answer

Network Watcher

Answer

Azure Traffic Manager

Question 5

Which TWO Azure Policy effects can be used to prevent the creation of non-compliant resources?

Accepted Answer

Deny. The 'Deny' effect (Option C) is correct because it actively blocks any resource creation or update request that violates a policy rule, ensuring non-compliant resources are never deployed. The 'Modify' effect (Option D) is also correct because it can add or change resource properties during creation or update to enforce compliance, effectively preventing non-compliant configurations from being created. Both effects operate at the time of the resource request, stopping non-compliant resources before they exist.

Answer

Audit

Answer

Append

Answer

Manual

Question 6

Which THREE methods can you use to authenticate users to Azure resources using Microsoft Entra ID?

Accepted Answer

OAuth 2.0 authorization code flow. OAuth 2.0 authorization code flow is the only method listed that authenticates a user interactively via Microsoft Entra ID. It allows a client application to obtain an access token on behalf of a user after the user has signed in, supporting SSO, MFA, and conditional access. Service principal with client certificate and managed identities are designed for application or service authentication, not user authentication. API keys and shared access signatures (SAS) tokens are access control mechanisms that do not verify user identity through Microsoft Entra ID.

Answer

API keys

Answer

Service principal with client certificate

Answer

Managed identities for Azure resources

Answer

Shared access signatures (SAS) tokens

Question 7

Your company is migrating on-premises applications to Azure. You need to ensure that users can sign in using their existing on-premises Active Directory credentials without duplicating accounts. Which identity solution should you recommend?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (formerly Azure AD Connect) is the correct solution because it synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to sign in with their existing credentials via password hash synchronization, pass-through authentication, or federation. This avoids duplicating accounts by maintaining a single identity source of truth, with optional seamless single sign-on (SSO) for a transparent experience.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra External ID

Answer

Microsoft Entra Domain Services

Question 8

You are designing a governance strategy for a new Azure subscription. The security team requires that all resources must have a 'CostCenter' tag and an 'Environment' tag. Which Azure policy effect should you use to automatically apply the tags to new resources?

Accepted Answer

modify. The 'modify' effect is correct because it can automatically append or replace missing tags on new or existing non-compliant resources during resource creation or update. Unlike 'deployIfNotExists', which only runs remediation tasks after creation, 'modify' applies the tags inline as part of the resource creation request, ensuring compliance without requiring a separate remediation task.

Answer

audit

Answer

deny

Answer

deployIfNotExists

Question 9

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to implement a lifecycle workflow that automatically disables user accounts when employees leave the organization, and then deletes them after 30 days. What should you use?

Accepted Answer

Microsoft Entra ID Governance. Microsoft Entra ID Governance includes lifecycle workflows that automate the process of disabling and deleting user accounts based on triggers such as employee departure. This feature allows you to configure a workflow that disables the account immediately and then schedules deletion after a specified period, such as 30 days, without requiring custom scripting or manual intervention.

Answer

Microsoft Entra Domain Services

Answer

Microsoft Intune

Answer

Microsoft Entra Connect Health

Question 10

You need to configure a monitoring solution for Azure virtual machines that collects performance counters, event logs, and enables alerting based on CPU usage exceeding 90%. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a unified platform for collecting performance counters and event logs from Azure VMs via the Log Analytics agent or Azure Monitor Agent, and it supports metric-based alert rules that can trigger when CPU usage exceeds a defined threshold (e.g., 90%). This directly meets the requirements for monitoring, log collection, and alerting without additional services.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Update Manager

Question 11

Your company uses Microsoft Entra ID and has a custom application that requires users to have specific roles assigned. You need to ensure that role assignments are reviewed quarterly and automatically remove assignments that are not approved. Which feature should you use?

Accepted Answer

Microsoft Entra ID Governance access reviews. Microsoft Entra ID Governance access reviews enable you to create recurring reviews of role assignments, with automatic removal of assignments that reviewers do not approve. This directly meets the requirement for quarterly reviews and automatic removal of unapproved assignments, making it the correct choice.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 12

Refer to the exhibit. You assign this Azure Policy to a management group. A user creates a new virtual machine without any tags. What will happen?

Accepted Answer

The virtual machine is created with the 'Environment' tag automatically added.. The Azure Policy in the exhibit uses the 'DeployIfNotExists' effect, which automatically deploys a tag (e.g., 'Environment') to resources that lack it during creation or update. Since the policy is assigned at the management group level, it applies to all child subscriptions and resources, including new virtual machines. When a user creates a VM without tags, the policy evaluates the resource and adds the missing tag without denying the creation or requiring manual intervention.

Answer

The policy is not evaluated because the resource is new.

Answer

The virtual machine creation is denied.

Answer

The virtual machine is created without the tag, and a compliance alert is generated.

Question 13

You need to monitor the sign-in activities of users in Microsoft Entra ID and detect risky sign-ins, such as those from anonymous IP addresses. Which service should you use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct service because it is specifically designed to detect and respond to risky sign-in activities, including sign-ins from anonymous IP addresses, using machine learning-based risk detection policies. It integrates directly with Microsoft Entra ID to evaluate sign-in risk in real time and can automatically block or require multi-factor authentication based on configured risk thresholds.

Answer

Microsoft Defender XDR

Answer

Azure Monitor

Answer

Microsoft Sentinel

Question 14

Your company has multiple Azure subscriptions. You need to create a single query that aggregates resource utilization metrics across all subscriptions and visualizes them in a dashboard. Which combination of Azure services should you use?

Accepted Answer

Azure Resource Graph and Azure Monitor Workbooks. Azure Resource Graph (ARG) can query across multiple subscriptions, resource groups, and resource types in a single query, making it ideal for aggregating utilization metrics. Azure Monitor Workbooks then provide a flexible, interactive canvas to visualize those query results in a dashboard, supporting rich visualizations and parameterized inputs.

Answer

Azure Monitor Log Analytics workspace and Azure Dashboards

Answer

Azure Policy and Azure Monitor Alerts

Answer

Microsoft Sentinel and Azure Playbooks

Question 15

Your organization uses Microsoft Entra ID and requires that all external users invited via B2B collaboration must authenticate using multi-factor authentication (MFA). You need to enforce this for all guest users. What should you configure?

Accepted Answer

Microsoft Entra Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA for guest users by targeting the 'Guest or external users' identity type and requiring MFA as a grant control. This provides granular control over authentication requirements for B2B collaboration users, unlike the other options which either lack enforcement capability or apply to different scenarios.

Answer

Microsoft Entra B2B collaboration settings

Answer

Microsoft Entra Identity Protection user risk policy

Answer

Microsoft Entra ID MFA registration policy