AZ-305 Design identity, governance, and monitoring solutions Practice Test 12 — 15 Questions

Question 1

You need to monitor the performance and health of your Azure virtual machines, including custom metrics and logs. You also need to set up alerts based on specific thresholds. Which Azure service should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Monitor. Azure Monitor is the correct choice because it provides a comprehensive solution for collecting, analyzing, and acting on telemetry from Azure virtual machines, including custom metrics and logs. It integrates with the Azure Monitor Agent to gather performance counters and event logs, and supports metric alerts and log alerts based on specific thresholds, directly meeting all stated requirements.

Answer

Application Insights

Answer

Azure Service Health

Answer

Log Analytics

Question 2

Your organization uses Microsoft Entra ID and requires that all external users accessing resources must be approved by a designated reviewer. You need to automate the review process for external identities. What should you implement?

Accepted Answer

Microsoft Entra access reviews. Microsoft Entra access reviews allow you to automate the periodic review of external identities, ensuring that only approved users retain access. This feature directly supports the requirement for a designated reviewer to approve or deny external users, with automated reminders and results. It is the correct choice because it is purpose-built for governance of external identities in Entra ID.

Answer

Microsoft Purview

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Question 3

You are designing a monitoring solution for a critical application running on Azure Kubernetes Service (AKS). The application generates custom metrics that need to be queried in real-time for dashboards. You also need to retain logs for one year for compliance. Which combination of services should you use?

Accepted Answer

Azure Monitor Metrics and Azure Monitor Logs. Azure Monitor Metrics is the correct choice for real-time querying of custom metrics because it stores numeric time-series data with sub-minute granularity and supports near real-time alerting and dashboarding via Azure Dashboards or Grafana. Azure Monitor Logs (Log Analytics) is required for retaining logs for one year, as it offers configurable retention up to 730 days (2 years) and supports KQL queries for compliance and audit needs. Together, they provide a unified monitoring solution for AKS that meets both real-time metric querying and long-term log retention requirements.

Answer

Prometheus and Azure Monitor Logs

Answer

Azure Data Explorer and Azure Blob Storage

Answer

Application Insights and Azure Storage

Question 4

Your company plans to use Microsoft Sentinel for security information and event management (SIEM). You need to ingest security logs from multiple Azure resources and on-premises servers. Which data connector should you use for Windows servers on-premises?

Accepted Answer

Azure Monitor Agent. The Azure Monitor Agent (AMA) is the correct choice because it is the current, recommended data collection agent for Microsoft Sentinel, replacing the legacy Log Analytics agent. It supports collecting security logs from Windows servers on-premises via the Windows Security Events via AMA connector, which uses data collection rules (DCRs) for flexible, scalable log ingestion. AMA is optimized for Sentinel's SIEM requirements and provides better performance, security, and manageability than its predecessor.

Answer

Log Analytics agent

Answer

Microsoft Defender for Cloud agent

Answer

Azure Arc agent

Question 5

You are designing an identity solution for a large enterprise that uses Microsoft Entra ID. The company has a partner organization that needs access to a specific application. The partner uses their own identity provider (IdP). You need to enable seamless access without duplicating user accounts. What should you configure?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD B2B) is the correct solution because it allows the partner organization to access the specific application using their own identity provider (IdP) without requiring duplicate user accounts in your tenant. It leverages federation trust, enabling seamless single sign-on (SSO) by authenticating users against their home IdP and issuing a token for your application. This aligns with the requirement for a zero-trust, external identity scenario where user lifecycle is managed externally.

Answer

Federation with the partner's IdP

Answer

Passwordless authentication

Answer

Identity synchronization

Question 6

Your Azure subscription contains multiple virtual machines (VMs) that run a line-of-business application. You need to configure alerts when the CPU usage exceeds 90% for more than 5 minutes. Additionally, the alert must automatically trigger a runbook to scale out the application. Which Azure service should you use to create this alert?

Accepted Answer

Azure Monitor metric alert. Azure Monitor metric alerts can evaluate resource metrics like CPU usage at a specified frequency and trigger actions when a threshold (e.g., 90%) is breached for a given duration (e.g., 5 minutes). The alert can invoke an Automation runbook via an action group, enabling automatic scaling of the application. This is the correct service because it directly supports metric-based alerting with multi-condition evaluation and action group integration.

Answer

Azure Automation

Answer

Azure Logic Apps

Answer

Azure Autoscale

Question 7

Which TWO of the following are true about Microsoft Entra ID Governance features?

Accepted Answer

Access reviews allow administrators to periodically review and attest to access rights.. Microsoft Entra ID Access Reviews enable administrators to periodically review and attest to the access rights of users, groups, or applications, ensuring that only authorized users retain access. This is a core governance feature that helps organizations meet compliance and security requirements by automating the certification process.

Answer

Conditional Access policies govern access based on location and device.

Answer

Privileged Identity Management (PIM) provides just-in-time access for all users.

Answer

Identity Protection automatically blocks all risky sign-ins.

Question 8

Which TWO of the following are valid Azure Policy effects that can be used to enforce compliance?

Accepted Answer

DeployIfNotExists. DeployIfNotExists (A) is a valid Azure Policy effect that enforces compliance by deploying a related resource when a specified resource does not exist, using a managed identity to perform the deployment. Deny (B) is also a valid effect that enforces compliance by blocking a resource request that violates the policy definition, causing the deployment to fail. AuditIfNotExists (C) is a real effect, but it only logs a non-compliance warning rather than enforcing compliance, so it is not one of the two enforcement effects. Modify (D) is a valid effect that adds or updates properties during deployment, but it is not marked correct here. AutoRemediate (E) is not an Azure Policy effect; remediation is a separate task performed via remediation tasks, not an effect name.

Answer

AuditIfNotExists

Answer

Modify

Answer

AutoRemediate

Question 9

Which THREE of the following are required to collect Windows security events into Microsoft Sentinel?

Accepted Answer

Log Analytics workspace. A Log Analytics workspace is required because Microsoft Sentinel is built on top of it; all security events collected by Sentinel are stored in the workspace's tables, and Sentinel uses the workspace as its data repository for analytics, alerting, and investigation.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 10

Refer to the exhibit. You create this Conditional Access policy in Microsoft Entra ID. What is the result?

Accepted Answer

All users are prompted for MFA when accessing any application from a browser or mobile app.. The exhibit shows a Conditional Access policy that applies to 'All users' and targets 'All cloud apps' with the grant control set to 'Require multi-factor authentication'. This configuration forces every user, including administrators and external users, to complete MFA when accessing any cloud application from any platform (browser or mobile app). Option B correctly states this universal MFA requirement.

Answer

Only administrators are prompted for MFA.

Answer

External users are prompted for MFA.

Answer

Access is blocked for all users.

Question 11

Refer to the exhibit. You run this Kusto query in Azure Monitor Logs. What does it return?

Accepted Answer

Computers that have not sent a heartbeat in the last 5 minutes.. The query uses the `Heartbeat` table and filters for heartbeats older than 5 minutes (`ago(5m)`). The `where` clause selects records where `TimeGenerated` is less than 5 minutes ago, meaning it finds heartbeats that were sent before that threshold. The `distinct Computer` then returns only computers whose most recent heartbeat is older than 5 minutes, i.e., computers that have not sent a heartbeat in the last 5 minutes. This is a common pattern for detecting unresponsive or offline machines.

Answer

The number of heartbeats per computer in the last hour.

Answer

Computers that sent a heartbeat in the last 5 minutes.

Answer

The average heartbeat frequency per computer.

Question 12

You are designing a monitoring solution for a critical application hosted on Azure Virtual Machines. The application is latency-sensitive and you need to be alerted when CPU usage exceeds 90% for more than 5 minutes. Which Azure Monitor feature should you use?

Accepted Answer

Metric alert. Metric alerts in Azure Monitor evaluate resource metrics (like CPU percentage) at regular intervals and trigger actions when a threshold is breached for a specified duration. Since the question involves a latency-sensitive application and a numeric threshold (CPU > 90% for 5 minutes), a metric alert is the correct choice because it provides near-real-time, low-latency evaluation directly from the VM's performance counters.

Answer

Service health alert

Answer

Log alert

Answer

Activity log alert

Question 13

Your organization is implementing a zero-trust security model. You need to ensure that all access to corporate resources from mobile devices is conditional based on device compliance, user risk, and location. Which Microsoft Entra ID feature should you use?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID are the correct choice because they allow you to enforce access controls based on conditions such as device compliance (via integration with Microsoft Intune), user risk (via integration with Identity Protection), and location (via IP ranges or named locations). This directly supports the zero-trust principle of 'never trust, always verify' by evaluating signals before granting access to corporate resources.

Answer

Identity Protection

Answer

Microsoft Intune

Answer

Microsoft Defender XDR

Question 14

Your company has multiple Azure subscriptions. You need to ensure that all security-related logs from Azure resources are centralized in a single Log Analytics workspace for analysis. Which Azure service should you use to collect and route these logs?

Accepted Answer

Azure Policy. Azure Policy is correct because it can enforce the deployment of a diagnostic setting on all Azure resources, automatically routing security-related logs (such as Activity Logs, resource logs, and audit logs) to a single Log Analytics workspace. This ensures centralized collection and analysis without manual configuration per resource, meeting the requirement for a governance-driven approach.

Answer

Azure Monitor

Answer

Microsoft Sentinel

Answer

Azure Event Hubs

Question 15

Your organization uses Microsoft Entra ID and has a hybrid identity deployment with Active Directory Domain Services (AD DS) on-premises. You need to synchronize user identities to Microsoft Entra ID, but you must ensure that password hashes are never stored in the cloud. Which synchronization method should you use?

Accepted Answer

Pass-through Authentication (PTA). Pass-through Authentication (PTA) is the correct choice because it validates user passwords directly against on-premises Active Directory without ever storing password hashes in Microsoft Entra ID. This meets the requirement that password hashes are never stored in the cloud, as PTA uses an agent on-premises to authenticate users, and only the validation result is sent to Microsoft Entra ID.

Answer

Password Hash Sync

Answer

Federation with AD FS

Answer

Azure AD Connect Cloud Sync