AZ-305 Design identity, governance, and monitoring solutions Practice Test 12 — 15 Questions

Question 1

Your organization is implementing a hybrid identity solution with Microsoft Entra ID. Users in an on-premises Active Directory domain need to access cloud applications. You need to ensure that password changes on-premises are synchronized to Entra ID within 30 seconds. Which configuration should you use?

Accepted Answer

Microsoft Entra Cloud Sync. Microsoft Entra Cloud Sync (Option C) is the correct choice because it is designed for near-real-time synchronization of identity changes, including password writes, with a target latency of under 30 seconds. It uses the lightweight Microsoft Entra Connect provisioning agent and the SCIM (System for Cross-domain Identity Management) protocol to sync changes from on-premises Active Directory to Entra ID, meeting the strict 30-second requirement for password change propagation.

Answer

Pass-through Authentication (PTA)

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Connect Sync with password hash synchronization

Question 2

Refer to the exhibit. You are reviewing an ARM template for deploying a storage account. The template is missing the storage account name parameter definition. What will happen when you attempt to deploy this template?

Accepted Answer

The deployment will fail with a validation error because the parameter is not defined.. In Azure Resource Manager (ARM) templates, all parameters must be explicitly defined in the `parameters` section of the template. If a parameter is referenced (e.g., in the `resources` section) but not defined, the deployment fails with a validation error before any resource provisioning begins. This is because ARM validates the template structure and parameter definitions during the pre-deployment validation phase, and an undefined parameter is considered a syntax error.

Answer

The deployment will prompt the user to provide the missing parameter.

Answer

The deployment will succeed using a default name based on the resource group.

Answer

The deployment will create a storage account with a random name.

Question 3

Your organization uses Azure Monitor to collect metrics from Azure resources. You need to create a custom metric alert that triggers when the average CPU usage of a specific virtual machine exceeds 80% for 10 minutes. Which TWO components are required? (Choose two.)

Accepted Answer

Metric alert rule. Option A is correct because an action group defines who gets notified. Option C is correct because a metric alert rule defines the condition. Option B is wrong because a Log Analytics workspace is not needed for metrics. Option D is wrong because a diagnostic setting is for sending logs, not for metrics alerts. Option E is wrong because a runbook is not required; you can use action groups to trigger automation.

Answer

Automation runbook

Answer

Log Analytics workspace

Answer

Diagnostic setting

Question 4

Your company is designing a governance strategy for Azure. You need to ensure that all resource groups in a subscription are created with a specific naming convention and mandatory tags. Which THREE services or features should you use together? (Choose three.)

Accepted Answer

Azure Blueprints. Azure Blueprints is correct because it enables the orchestrated deployment of Azure Policy, RBAC, and resource templates as a single composable artifact. By defining a blueprint that includes a policy for naming conventions and mandatory tags, you can enforce these requirements consistently across all resource groups within a subscription or management group hierarchy.

Answer

Azure RBAC

Answer

Resource Locks

Question 5

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to collect logs from on-premises firewalls and send them to Sentinel. Which TWO connectors can you use? (Choose two.)

Accepted Answer

Syslog. Syslog is a standard protocol for sending log messages from network devices, including firewalls, to a central collector. Common Event Format (CEF) is a syslog-based format that normalizes logs from different security products, making them easier to parse and analyze in Sentinel. Both connectors allow on-premises firewalls to forward their logs to a Log Analytics agent or AMA, which then sends them to Sentinel.

Answer

DNS

Answer

Azure Activity Log

Answer

Windows Security Events via AMA

Question 6

Your company uses Microsoft Entra ID. You need to implement a privileged identity management (PIM) strategy to secure administrative roles. Which TWO capabilities does PIM provide? (Choose two.)

Accepted Answer

Approval workflows for role activation. Privileged Identity Management (PIM) in Microsoft Entra ID provides time-based and approval-based role activation to secure privileged roles. Approval workflows for role activation (Option A) are a core PIM feature, allowing designated approvers to review and approve activation requests before a user gains elevated permissions. This ensures that privileged access is granted only after explicit authorization, reducing the risk of unauthorized use.

Answer

Conditional Access policies for role activation

Answer

Management of external identities

Answer

Automated user provisioning to applications

Question 7

Your organization uses Azure Monitor Logs to analyze application performance. You need to create a custom log query that calculates the 95th percentile of response times for a web app over the last 24 hours. Which THREE KQL functions should you use? (Choose three.)

Accepted Answer

percentile. The `percentile` function in KQL calculates percentile values, such as the 95th percentile, which is essential for analyzing response time distributions. The `summarize` function groups and aggregates data, allowing you to apply `percentile` across the dataset. The `where` function filters the log data to include only records from the last 24 hours, ensuring the query operates on the correct time range.

Answer

project

Answer

sort

Question 8

Your company has multiple Azure subscriptions and needs a single pane of glass to monitor the health and performance of all resources across subscriptions. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct choice because it provides a unified, single-pane-of-glass experience for collecting, analyzing, and acting on telemetry from all Azure resources across multiple subscriptions. It aggregates metrics, logs, and alerts from various sources, enabling cross-subscription monitoring of health and performance without requiring separate tools.

Answer

Microsoft Sentinel

Answer

Azure Service Health

Answer

Azure Advisor

Question 9

Your company is migrating on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate using their existing on-premises passwords and that password changes are synchronized immediately. The solution must minimize latency and avoid storing password hashes in the cloud. What should you implement?

Accepted Answer

Implement password hash synchronization with password writeback. Option B is correct because password hash synchronization with password writeback meets the requirement to synchronize password changes immediately while avoiding storing password hashes in the cloud. However, the question explicitly states 'avoid storing password hashes in the cloud,' which contradicts password hash synchronization (which does store hashes). The correct solution for immediate password change sync without cloud hash storage is Microsoft Entra Pass-through Authentication (Option A), which validates passwords on-premises without storing hashes in Azure AD. The exam trap is that password writeback is for cloud-to-on-premises sync, not immediate on-premises-to-cloud sync.

Answer

Implement Microsoft Entra Pass-through Authentication

Answer

Create cloud-only user accounts in Microsoft Entra ID

Answer

Federate with Active Directory Federation Services (AD FS)

Question 10

You are reviewing a Conditional Access policy for a Microsoft Entra ID tenant. The exhibit shows the policy configuration. Users report that they are prompted for MFA every hour even when using approved Microsoft applications. The security team wants to reduce MFA prompts but maintain security. What should you modify?

Accepted Answer

Increase the signInFrequency value to 24 hours. The sign-in frequency control in Conditional Access determines how often a user must re-authenticate. Increasing the value from 1 hour to 24 hours directly reduces the frequency of MFA prompts while still requiring re-authentication daily, balancing security and user experience. This change applies to approved Microsoft applications as configured in the policy.

Answer

Enable 'persistentBrowser' session control

Answer

Change cloudAppSecurityType to 'blockDownloads'

Answer

Remove the 'approvedApplication' grant control

Question 11

Your organization uses Microsoft Azure and has a subscription with multiple resource groups. You need to ensure that only users in the Finance department can access storage accounts in the 'Finance' resource group. The solution must use role-based access control (RBAC). What should you assign?

Accepted Answer

Assign the Storage Blob Data Reader role to the Finance users at the Finance resource group scope. Option B is correct because assigning the Storage Blob Data Reader role at the Finance resource group scope grants Finance users read access to blob data within all storage accounts in that resource group, using RBAC. This meets the requirement of restricting access to only the Finance department while leveraging Azure RBAC's built-in data plane role for storage.

Answer

Assign the Contributor role to the Finance users at the management group scope

Answer

Assign the Reader role to the Finance users at the subscription scope

Answer

Assign the Storage Account Contributor role to the Finance users at each storage account scope

Question 12

Your company uses Microsoft Sentinel for security monitoring. You need to design a solution that automatically responds to incidents involving high-severity alerts. The response should include creating an incident in Microsoft Teams and sending an email to the security team. What should you use?

Accepted Answer

Microsoft Sentinel automation rules and playbooks. Microsoft Sentinel automation rules and playbooks (built on Azure Logic Apps) are specifically designed to orchestrate automated responses to security incidents. When a high-severity alert triggers an incident, an automation rule can invoke a playbook that creates a Microsoft Teams message and sends an email via connectors like Office 365 Outlook, meeting the exact requirements.

Answer

Azure Policy with remediation tasks

Answer

Azure Monitor alert rules with action groups

Answer

Microsoft Defender for Cloud security alerts

Question 13

You are reviewing a custom RBAC role in Azure. The exhibit shows the role definition. A user with this role reports they cannot read diagnostic settings for a storage account in the Production resource group. What is the most likely cause?

Accepted Answer

The role does not include 'Microsoft.Storage/storageAccounts/read'. The user cannot read diagnostic settings because the custom role lacks the 'Microsoft.Storage/storageAccounts/read' permission. This permission is required to read the storage account resource itself, which is a prerequisite for accessing its diagnostic settings. Without it, the role cannot perform any read operations on the storage account, including reading diagnostic logs or metrics configuration.

Answer

Custom roles cannot be assigned to users

Answer

The role lacks the 'Microsoft.Storage/storageAccounts/listKeys/action' permission

Answer

The role is assigned at the wrong scope

Question 14

Your organization plans to use Azure Policy to enforce tagging on all resources. The tags must include 'CostCenter' and 'Environment'. Resources that do not have these tags should be automatically remediated. What should you use?

Accepted Answer

A policy with 'deployIfNotExists' effect and a remediation task. The 'deployIfNotExists' effect is correct because it allows Azure Policy to evaluate resources for missing tags and then deploy a remediation task that automatically adds the required tags. This effect is specifically designed for scenarios where non-compliance can be corrected by deploying or modifying resources, such as adding tags via a policy definition that triggers a remediation task.

Answer

A policy with 'append' effect

Answer

A policy with 'audit' effect

Answer

A policy with 'deny' effect

Question 15

Your company uses Microsoft Intune for device management. You need to ensure that only devices that are compliant with security policies can access corporate resources. The solution must also support legacy authentication protocols. What should you implement?

Accepted Answer

Conditional Access policies with 'Require device to be marked as compliant'. Option C is correct because the requirement is to enforce compliance-based access control for devices managed by Microsoft Intune, while also supporting legacy authentication protocols. Conditional Access policies with 'Require device to be marked as compliant' evaluate the device's compliance status reported by Intune and can block or allow access based on that status. This works with legacy authentication protocols (e.g., POP3, IMAP, SMTP) when combined with a compliance policy that does not require modern authentication, though legacy protocols are inherently less secure and should be used cautiously.

Answer

Microsoft Defender for Endpoint

Answer

Device-based Conditional Access with 'Require hybrid Azure AD joined device'

Answer

Microsoft Entra application proxy