AZ-305 Design identity, governance, and monitoring solutions Practice Test 11 — 15 Questions

Question 1

Your company has an Azure subscription with 100 virtual machines. You need to monitor the performance of these VMs and be alerted when the average CPU usage across a set of VMs exceeds 80% for 10 minutes. The set of VMs is defined by a tag (Environment=Production). Which Azure Monitor solution should you implement?

Accepted Answer

Create a metric alert rule with a dynamic threshold and scope it to a resource group containing Production VMs.. Option B is correct because a single metric alert rule with a static threshold can be scoped to a resource group and filtered by a tag (e.g., Environment=Production) using a dynamic threshold or static threshold, allowing you to monitor the average CPU usage across all VMs in that group without creating individual rules. This approach efficiently meets the requirement to alert when the average CPU usage across the set of VMs exceeds 80% for 10 minutes, as it aggregates metrics across the tagged VMs.

Answer

Use Azure Monitor VM Insights to visualize performance and set alerts per VM.

Answer

Create a metric alert rule with a static threshold of 80% for each Production VM individually.

Answer

Use a Log Analytics query to calculate average CPU and set a log alert.

Question 2

Your organization uses Microsoft Purview to govern data across Azure and on-premises sources. You need to ensure that sensitive data, such as credit card numbers, is automatically detected and classified in Azure Blob Storage. Which Purview feature should you configure?

Accepted Answer

Data classification scanning with built-in sensitive information types. Option C is correct because Microsoft Purview's data classification scanning can be configured to automatically detect sensitive data like credit card numbers using built-in sensitive information types (e.g., Credit Card Number). When a scan is run against Azure Blob Storage, Purview identifies and classifies the data based on these predefined patterns, enabling governance and compliance.

Answer

Microsoft Sentinel

Answer

Data catalog search

Answer

Data lineage tracking

Question 3

Your company has an Azure subscription that contains 100 virtual machines (VMs). You are designing a monitoring solution that must meet the following requirements: - Alert when any VM's CPU usage exceeds 90% for 15 minutes. - Alert when any VM's available memory drops below 1 GB. - Provide a centralized dashboard showing real-time performance metrics for all VMs. Which TWO Azure services should you include in the solution? (Choose two.)

Accepted Answer

Azure Monitor. Azure Monitor is the core service for collecting, analyzing, and acting on telemetry from Azure resources. It can collect CPU and memory metrics from VMs via the Azure Monitor Agent, and its alerting engine can trigger actions when CPU exceeds 90% for 15 minutes or available memory drops below 1 GB, meeting both alerting requirements.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Automation

Question 4

Your organization is designing a governance solution for multiple Azure subscriptions. You need to enforce that all resources are created in specific Azure regions (East US and West Europe only). Additionally, any resource group must have a cost center tag. Which THREE Azure components should you use? (Choose three.)

Accepted Answer

Azure Policy. Azure Policy is correct because it allows you to define and enforce rules for resource creation, such as restricting allowed locations to East US and West Europe. By assigning a built-in or custom policy definition to a management group or subscription, you can prevent any resource from being created outside the specified regions. This directly addresses the requirement to enforce regional compliance.

Answer

Azure Blueprints

Answer

Role-Based Access Control (RBAC)

Question 5

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that automatically blocks sign-ins from risky users and requires multi-factor authentication (MFA) when a sign-in risk is detected. Which TWO services should you use? (Choose two.)

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (B) is the service that detects sign-in risks (e.g., anonymous IP, atypical travel) and labels users or sign-ins as risky. Conditional Access policies (E) then enforce automated responses, such as blocking the sign-in or requiring MFA, based on the risk level from Entra ID Protection. Together, they provide the detection and enforcement mechanism described in the requirement.

Answer

Microsoft Purview

Answer

Microsoft Defender XDR

Answer

Microsoft Intune

Question 6

Refer to the exhibit. You are an Azure administrator reviewing a custom Azure Policy definition. What does this policy do?

Accepted Answer

Denies the creation of virtual machines with the SKUs Standard_D2s_v3 or Standard_D4s_v3.. The policy definition uses the 'deny' effect, which blocks any request that matches the specified condition. The condition checks if the virtual machine SKU is either 'Standard_D2s_v3' or 'Standard_D4s_v3' using the 'in' operator on the 'Microsoft.Compute/virtualMachines/sku.name' alias. Therefore, any attempt to create a VM with these SKUs will be denied, making Option A correct.

Answer

Denies the creation of resource groups that contain virtual machines with the specified SKUs.

Answer

Allows only virtual machines with the SKUs Standard_D2s_v3 or Standard_D4s_v3 to be created in a specific region.

Answer

Audits virtual machines to check if they have the SKUs Standard_D2s_v3 or Standard_D4s_v3.

Question 7

Refer to the exhibit. You are deploying a Log Analytics workspace using an ARM template with the parameters shown. Your compliance team requires that all log data be retained for at least 2 years. Which parameter value should you modify?

Accepted Answer

retentionInDays. The `retentionInDays` parameter controls how long log data is retained in a Log Analytics workspace. To meet the compliance requirement of at least 2 years (730 days), you must set this value to 730 or higher. The default retention is 30 days for free tiers and up to 730 days for paid tiers, but the parameter must be explicitly modified to enforce the 2-year retention.

Answer

workspaceName

Answer

sku

Answer

dailyQuotaGb

Question 8

Refer to the exhibit. You are deploying an ARM template that assigns a policy to audit virtual machines not using managed disks. After deployment, you need to verify that the policy assignment is working. Which Azure CLI command should you run?

Accepted Answer

az policy assignment list --subscription 12345678-1234-1234-1234-123456789abc. Option A is correct because the `az policy assignment list` command retrieves all policy assignments in the specified subscription, including the one deployed via the ARM template. This allows you to confirm that the policy assignment exists and is properly configured. To verify that the policy is actually evaluating resources and producing compliance states, you would then use `az policy state list` to see the compliance results, but the question specifically asks to verify that the assignment itself is working, which is done by listing assignments.

Answer

az policy state list --resource-group myResourceGroup

Answer

az policy definition list --subscription 12345678-1234-1234-1234-123456789abc

Answer

az policy event list --subscription 12345678-1234-1234-1234-123456789abc

Question 9

Your company is deploying Microsoft Entra ID Governance and needs to ensure that guest users' access to internal applications expires after 90 days. Which feature should you configure?

Accepted Answer

Entitlement management. Entitlement management in Microsoft Entra ID Governance allows you to create access packages that govern guest user access to internal applications. You can configure an access package with a specific expiration policy, such as setting the access to expire after 90 days, ensuring automatic removal of guest access without manual intervention.

Answer

Privileged Identity Management (PIM)

Answer

Access reviews

Answer

Conditional Access policies

Question 10

Your organization uses Microsoft Sentinel for security monitoring. You need to ensure that all sign-in logs from Microsoft Entra ID are ingested into a Log Analytics workspace in real time. Which diagnostic setting should you configure?

Accepted Answer

SignInLogs. The SignInLogs diagnostic setting captures all user sign-in activities, including interactive and non-interactive sign-ins, which is required for real-time ingestion of all sign-in logs from Microsoft Entra ID into a Log Analytics workspace. This setting ensures that every authentication event is streamed to Sentinel for security monitoring without delay.

Answer

NonInteractiveUserSignInLogs

Answer

AuditLogs

Answer

ServicePrincipalSignInLogs

Question 11

Refer to the exhibit. You are a security administrator reviewing a custom Azure Policy assignment. The policy definition with ID 'abc123' is an initiative containing two policies: one that audits storage accounts with blob public access enabled and one that deploys a diagnostic setting for network security groups. The scope includes a production resource group. However, the compliance state shows 'Non-compliant' for several resources. What is the most likely reason for the non-compliance?

Accepted Answer

The diagnostic setting deployment policy requires a remediation task to bring non-compliant resources into compliance.. Option D is correct because the policy that deploys a diagnostic setting for network security groups is a 'DeployIfNotExists' (DINE) policy. DINE policies do not automatically remediate existing non-compliant resources; they require a remediation task to be created and run, which will deploy the diagnostic settings to bring the resources into compliance. The audit-only policy for storage accounts does not require remediation, but the DINE policy's non-compliance indicates that the diagnostic settings are missing and need to be deployed via a remediation task.

Answer

The scope is incorrectly targeting the resource group, missing the subscription.

Answer

The audit policy is preventing the creation of storage accounts with public access.

Answer

The enforcement mode is set to 'Default' which disables policy evaluation.

Question 12

Your company is implementing a monitoring solution for Azure virtual machines. You need to collect performance counters and log events from the VMs and send them to a centralized Log Analytics workspace. Which agent should you install on the VMs?

Accepted Answer

Azure Monitor Agent. Azure Monitor Agent (AMA) is the current recommended agent for collecting performance counters and log events from Azure VMs and sending them to a Log Analytics workspace. It replaces the legacy Log Analytics agent (MMA) and offers centralized management via data collection rules (DCRs), improved security, and support for both Windows and Linux VMs. The AMA uses the Azure Monitor service pipeline and supports multi-homing to multiple workspaces natively.

Answer

Log Analytics agent (MMA)

Answer

Diagnostics Extension

Answer

Dependency Agent

Question 13

Your organization uses Azure Policy to enforce tagging standards. You need to ensure that any resource created without the required 'CostCenter' tag is automatically remediated by adding the tag with a default value. Which policy effect should you use?

Accepted Answer

modify. Option C is correct because the 'modify' effect can add tags to resources during creation or on existing resources via remediation. Option A is wrong because 'deny' blocks creation. Option B is wrong because 'audit' only logs non-compliance. Option D is wrong because 'append' adds the tag at creation but does not support remediation for existing resources.

Answer

append

Answer

deny

Answer

audit

Question 14

Refer to the exhibit. A user reports they cannot access a secret in the vault 'vault-prod'. The user has a Contributor role at the subscription scope and a Key Vault Secrets User role at the specific vault scope. What is the most likely reason for the failure?

Accepted Answer

The vault uses access policies instead of RBAC for authorization.. Option D is correct because Key Vault has two permission models: RBAC and access policies. If the vault is using access policies, RBAC assignments are ignored unless the vault is configured for RBAC authorization. Option A is wrong because Contributor at subscription includes write access to vaults. Option B is wrong because the user has the secrets user role. Option C is wrong because the scope is correct.

Answer

The user does not have write permissions on the vault.

Answer

The Key Vault Secrets User role does not allow reading secrets.

Answer

The scope of the Key Vault Secrets User role is incorrect.

Question 15

Your company uses Azure Resource Manager templates for infrastructure deployment. You need to ensure that all deployments are validated against organizational policies before resources are provisioned. Which Azure service should you use?

Accepted Answer

Azure Policy. Option B is correct because Azure Policy can be used with a 'deny' effect to prevent non-compliant deployments. Option A is wrong because Azure Blueprints bundles artifacts but does not enforce policies. Option C is wrong because RBAC controls access but not resource compliance. Option D is wrong because Management Groups organize subscriptions but do not validate deployments.

Answer

Azure RBAC

Answer

Management Groups

Answer

Azure Blueprints