AZ-305 Design identity, governance, and monitoring solutions Practice Test 12 — 15 Questions

Question 1

Which TWO actions should you take to ensure that only authorized users can access sensitive data stored in Azure Blob Storage? (Choose two.)

Accepted Answer

Configure Azure RBAC roles to grant access to specific users.. Azure RBAC roles allow you to grant granular permissions to specific users or groups, ensuring that only authorized identities can access sensitive data in Blob Storage. By assigning built-in roles like 'Storage Blob Data Reader' or 'Storage Blob Data Contributor', you enforce identity-based access control at the storage account, container, or blob level. This directly addresses the requirement of restricting access to authorized users. Infrastructure encryption, on the other hand, only protects data at rest but does not control who can access the data.

Answer

Configure firewall rules to allow only specific IP addresses.

Answer

Enable blob versioning.

Answer

Enable soft delete for blobs.

Answer

Enable infrastructure encryption.

Question 2

Which THREE conditions should be met to implement a successful Azure landing zone for a new enterprise subscription? (Choose three.)

Accepted Answer

A management group hierarchy that separates environments.. A management group hierarchy that separates environments (e.g., production, non-production, and management) is a core design principle of an Azure landing zone. It enables policy inheritance, role-based access control (RBAC) isolation, and cost tracking across different workloads, aligning with the Cloud Adoption Framework's governance best practices.

Answer

A dedicated Azure Active Directory tenant.

Answer

Microsoft Sentinel enabled for security monitoring.

Question 3

Which TWO features of Microsoft Entra ID help protect against credential compromise? (Choose two.)

Accepted Answer

Microsoft Entra Password Protection. Microsoft Entra Password Protection automatically blocks weak passwords and common password variations (e.g., 'Password123!') by comparing them against a global banned password list and an optional custom banned password list. This directly prevents users from setting easily guessable credentials, reducing the risk of credential compromise.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra access reviews

Question 4

Refer to the exhibit. You run this PowerShell script in an Azure subscription. The script executes successfully. What is the outcome?

Accepted Answer

All resources without tags get the tag 'Environment' with value 'Unknown'.. The `Update-AzTag` cmdlet with the `-Operation Merge` parameter merges the specified tags into existing resource tags without removing any existing tags. When a resource already has tags, only the specified tag is added or updated; when a resource has no tags, the specified tag is applied. This matches option B: all resources without tags get the tag 'Environment' with value 'Unknown'.

Answer

All existing tags are replaced with 'Environment'='Unknown'.

Answer

All resources in the subscription get the tag 'Environment' with value 'Unknown'.

Answer

The script fails because Update-AzTag does not support merge.

Question 5

Refer to the exhibit. You deploy this ARM template to create an Azure Monitor Workbook. The template deploys successfully. What will the workbook display?

Accepted Answer

CPU utilization averaged over 5-minute intervals.. The ARM template configures an Azure Monitor Workbook to query the `InsightsMetrics` table for the `cpu_usage_percentage` metric, which is collected by Azure Monitor Agent (AMA) at a default granularity of 1 minute. The workbook uses the `avg` aggregation and a time grain of `5m` (5 minutes) in the query, so it displays CPU utilization averaged over 5-minute intervals. The `summarize` operator with `bin(TimeGenerated, 5m)` explicitly groups data into 5-minute buckets, making option B correct.

Answer

CPU utilization averaged over 1-hour intervals.

Answer

Memory utilization over time.

Answer

Disk I/O utilization over time.

Question 6

Refer to the exhibit. You assign this Azure Policy to a resource group. A user attempts to create a new Azure SQL Server without specifying an administrator login. What will happen?

Accepted Answer

The SQL Server creation is denied.. The Azure Policy assigned to the resource group includes a condition that checks if the 'administratorLogin' property is missing or null when creating a SQL Server. Since the user does not specify an administrator login, the condition evaluates to true, triggering the 'deny' effect. This prevents the creation of the SQL Server entirely, as Azure Policy enforces compliance before the resource is provisioned.

Answer

The SQL Server is created with a default administrator login.

Answer

The policy is ignored because the condition is not met.

Answer

The SQL Server is created but a compliance alert is generated.

Question 7

Your company has a Microsoft Entra ID tenant with 50,000 users. You need to design a solution to ensure that users can reset their own passwords without help desk intervention, while preventing password reuse for the last 10 passwords. Which feature should you enable?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without help desk intervention. Additionally, SSPR can be configured with password protection policies that enforce password history, preventing reuse of the last 10 passwords. This directly meets both requirements stated in the question.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Connect

Answer

Privileged Identity Management (PIM)

Question 8

You are designing a monitoring solution for a critical application hosted on Azure Virtual Machines. The application experiences intermittent high CPU usage that lasts for 10 minutes. You need to be notified within 5 minutes of the start of each occurrence. The solution must minimize false alerts. What should you use?

Accepted Answer

Azure Monitor metric alert with a dynamic threshold and 5-minute frequency, alert on 2 consecutive breaches. Azure Monitor metric alerts with dynamic thresholds adapt to normal CPU patterns, minimizing false alerts. The '5-minute frequency' refers to the aggregation granularity (the metric is averaged over 5-minute windows), while the evaluation frequency is every 1 minute. Requiring 2 consecutive breaches means the alert fires if two successive 1-minute data points exceed the dynamic threshold. Since the CPU spike lasts 10 minutes, the first breach occurs within 1 minute of the start, and the second breach occurs 1 minute later, triggering the alert within 2 minutes of the start. This satisfies the 5-minute notification requirement while minimizing false alerts through adaptive thresholds.

Answer

Azure Monitor log alert querying Perf table every 1 minute

Answer

Create an Azure Monitor action group that sends email

Answer

Azure Monitor metric alert with a static threshold of 90% CPU

Question 9

Your company uses Microsoft Entra ID for identity management. You need to ensure that only devices compliant with your company's security policies can access corporate resources. Which solution should you implement?

Accepted Answer

Conditional Access with device compliance policies from Microsoft Intune. Conditional Access in Microsoft Entra ID allows you to enforce access controls based on conditions, including device compliance. By integrating with Microsoft Intune, you can define device compliance policies (e.g., requiring encryption, a minimum OS version, or anti-malware status) and then configure a Conditional Access policy to block or grant access only to devices that are marked as compliant. This directly ensures that only compliant devices can access corporate resources.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Sentinel

Answer

Microsoft Defender XDR

Question 10

Your organization uses Microsoft Entra ID and Azure Key Vault. You need to ensure that a custom application can securely access secrets in Key Vault without storing credentials in code. The application runs on an Azure Virtual Machine. What should you use?

Accepted Answer

Assign a system-assigned managed identity to the VM. A system-assigned managed identity for Azure Virtual Machines allows the application to authenticate to Azure Key Vault without storing any credentials in code. Azure automatically manages the identity's lifecycle and tokens, enabling the VM to obtain an access token from Azure AD (now Microsoft Entra ID) to call Key Vault's REST API. This aligns with the principle of zero-trust and eliminates the need for service principals or certificates in the application.

Answer

Store the Key Vault URL and connection string in the application configuration

Answer

Create a service principal and upload a certificate to the VM

Answer

Use a shared access signature (SAS) token

Question 11

Refer to the exhibit. You are reviewing an Azure Resource Manager deployment configuration. The deployment is failing with a conflict error. What is the most likely cause?

Accepted Answer

The debugSetting includes requestContent, which may cause the request to exceed size limits. Including `requestContent` in the `debugSetting` property of an ARM template deployment causes the entire HTTP request payload to be logged. For large templates or parameter files, this can exceed the Azure Resource Manager API request size limit (typically 4 MB), resulting in a conflict error (HTTP 409) as the service rejects the oversized request.

Answer

The deployment mode is Incremental instead of Complete

Answer

The template is not parameterized

Answer

The onError property is set to DeploymentRollback

Question 12

Your company uses Microsoft Sentinel for security monitoring. You need to design a solution to analyze sign-in logs and detect patterns of anomalous access from different geographical locations within a short time frame. Which feature should you use?

Accepted Answer

Kusto Query Language (KQL) queries. C is correct because Kusto Query Language (KQL) queries are the native query language used in Microsoft Sentinel to perform deep analysis of log data, including sign-in logs. To detect patterns of anomalous access from different geographical locations within a short time frame, you would write a KQL query that aggregates sign-in events by user, timestamp, and location, then applies threshold-based logic (e.g., multiple distinct countries within 10 minutes) to surface the anomaly. This is a custom detection scenario that requires direct querying of the Log Analytics workspace, which KQL enables.

Answer

Microsoft Sentinel Analytics Rules

Answer

Microsoft Sentinel Playbooks

Answer

Microsoft Sentinel Workbooks

Question 13

Your organization plans to deploy Microsoft Entra ID Governance. You need to ensure that access to critical applications is reviewed quarterly by the application owners. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra ID Access Reviews. Microsoft Entra ID Access Reviews (Option D) is the correct feature because it enables recurring, delegated review of user access to applications, groups, or roles. By configuring an access review with quarterly frequency and assigning application owners as reviewers, you directly meet the requirement for periodic attestation of access to critical applications. This is the specific Entra ID capability designed for governance-driven access recertification.

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Entitlement Management

Answer

Microsoft Entra ID Terms of Use

Question 14

You are designing a monitoring solution for an Azure function app that processes messages from Azure Service Bus. The function app is critical and must be highly available. You need to monitor for poison messages and trigger an alert when the dead-letter queue count exceeds 100. What should you use?

Accepted Answer

Azure Monitor metric alert on the dead-letter message count. Azure Monitor metric alerts can directly monitor the 'Dead-letter message count' metric for a Service Bus namespace or entity. When this count exceeds 100, the alert triggers, enabling automated response to poison messages without additional query overhead. This is the most efficient and native monitoring solution for real-time threshold-based alerts on Service Bus metrics.

Answer

Azure Service Bus Explorer

Answer

Azure Log Analytics workspace querying Service Bus logs

Answer

Azure Application Insights availability tests

Question 15

Which THREE Azure Monitor capabilities can be used to detect and diagnose performance issues in a multi-tier application?

Accepted Answer

Live Metrics Stream in Application Insights. Live Metrics Stream in Application Insights (Option C) provides real-time monitoring of application performance metrics, such as request rates, response times, and failure rates, with sub-second latency. This allows immediate detection of performance issues as they occur, making it ideal for diagnosing live problems in a multi-tier application.

Answer

Azure Monitor Workbooks

Answer

Azure Policy