AZ-305 Design identity, governance, and monitoring solutions Practice Test 13 — 15 Questions

Question 1

Your company has an Azure subscription with 100 virtual machines. You need to monitor the performance of these VMs and be alerted when the average CPU usage across a set of VMs exceeds 80% for 10 minutes. The set of VMs is defined by a tag (Environment=Production). Which Azure Monitor solution should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Log Analytics query to calculate average CPU and set a log alert.. The requirement is to alert when the average CPU usage across a set of VMs (tagged Environment=Production) exceeds 80% for 10 minutes. Metric alert rules (including dynamic thresholds) evaluate per resource, not across multiple resources. Option D uses a Log Analytics query to calculate the average CPU usage across all VMs with the specified tag and then creates a log alert based on that query, which correctly aggregates the metric. Therefore, Option D is the correct solution.

Answer

Use Azure Monitor VM Insights to visualize performance and set alerts per VM.

Answer

Create a metric alert rule with a dynamic threshold and scope it to a resource group containing Production VMs.

Answer

Create a metric alert rule with a static threshold of 80% for each Production VM individually.

Question 2

Your organization uses Microsoft Purview to govern data across Azure and on-premises sources. You need to ensure that sensitive data, such as credit card numbers, is automatically detected and classified in Azure Blob Storage. Which Purview feature should you configure?

Accepted Answer

Data classification scanning with built-in sensitive information types. Microsoft Purview's data classification scanning can be configured to automatically detect sensitive data like credit card numbers using built-in sensitive information types (e.g., Credit Card Number). When a scan is run against Azure Blob Storage, Purview identifies and classifies the data based on these predefined patterns, enabling governance and compliance.

Answer

Microsoft Sentinel

Answer

Data catalog search

Answer

Data lineage tracking

Question 3

Your company has an Azure subscription that contains 100 virtual machines (VMs). You are designing a monitoring solution that must meet the following requirements: - Alert when any VM's CPU usage exceeds 90% for 15 minutes. - Alert when any VM's available memory drops below 1 GB. - Provide a centralized dashboard showing real-time performance metrics for all VMs. Which TWO Azure services should you include in the solution? (Choose two.)

Accepted Answer

Azure Monitor. Azure Monitor is the core service for collecting, analyzing, and acting on telemetry from Azure resources. It can collect CPU and memory metrics from VMs via the Azure Monitor Agent, and its alerting engine can trigger actions when CPU exceeds 90% for 15 minutes or available memory drops below 1 GB, meeting both alerting requirements.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Automation

Question 4

Your organization is designing a governance solution for multiple Azure subscriptions. You need to enforce that all resources are created in specific Azure regions (East US and West Europe only). Additionally, any resource group must have a cost center tag. Which THREE Azure components should you use? (Choose three.)

Accepted Answer

Azure Policy. Azure Policy is correct because it allows you to define and enforce rules for resource creation, such as restricting allowed locations to East US and West Europe. By assigning a built-in or custom policy definition to a management group or subscription, you can prevent any resource from being created outside the specified regions. This directly addresses the requirement to enforce regional compliance.

Answer

Azure Blueprints

Answer

Role-Based Access Control (RBAC)

Question 5

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that automatically blocks sign-ins from risky users and requires multi-factor authentication (MFA) when a sign-in risk is detected. Which TWO services should you use? (Choose two.)

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (B) is the service that detects sign-in risks (e.g., anonymous IP, atypical travel) and labels users or sign-ins as risky. Conditional Access policies (E) then enforce automated responses, such as blocking the sign-in or requiring MFA, based on the risk level from Entra ID Protection. Together, they provide the detection and enforcement mechanism described in the requirement.

Answer

Microsoft Purview

Answer

Microsoft Defender XDR

Answer

Microsoft Intune

Question 6

Refer to the exhibit. You are an Azure administrator reviewing a custom Azure Policy definition. What does this policy do?

Accepted Answer

Denies the creation of virtual machines with the SKUs Standard_D2s_v3 or Standard_D4s_v3.. The policy definition uses the 'deny' effect, which blocks any request that matches the specified condition. The condition checks if the virtual machine SKU is either 'Standard_D2s_v3' or 'Standard_D4s_v3' using the 'in' operator on the 'Microsoft.Compute/virtualMachines/sku.name' alias. Therefore, any attempt to create a VM with these SKUs will be denied, making Option A correct.

Answer

Denies the creation of resource groups that contain virtual machines with the specified SKUs.

Answer

Allows only virtual machines with the SKUs Standard_D2s_v3 or Standard_D4s_v3 to be created in a specific region.

Answer

Audits virtual machines to check if they have the SKUs Standard_D2s_v3 or Standard_D4s_v3.

Question 7

Refer to the exhibit. You are deploying a Log Analytics workspace using an ARM template with the parameters shown. Your compliance team requires that all log data be retained for at least 2 years. Which parameter value should you modify?

Accepted Answer

retentionInDays. The `retentionInDays` parameter controls how long log data is retained in a Log Analytics workspace. To meet the compliance requirement of at least 2 years (730 days), you must set this value to 730 or higher. The default retention is 30 days for free tiers and up to 730 days for paid tiers, but the parameter must be explicitly modified to enforce the 2-year retention.

Answer

workspaceName

Answer

sku

Answer

dailyQuotaGb

Question 8

Refer to the exhibit. You are deploying an ARM template that assigns a policy to audit virtual machines not using managed disks. After deployment, you need to verify that the policy assignment is working. Which Azure CLI command should you run?

Accepted Answer

az policy assignment list --subscription 12345678-1234-1234-1234-123456789abc. The `az policy assignment list` command retrieves all policy assignments in the specified subscription, including the one deployed via the ARM template. This allows you to confirm that the policy assignment exists and is properly configured. To verify that the policy is actually evaluating resources and producing compliance states, you would then use `az policy state list` to see the compliance results, but the question specifically asks to verify that the assignment itself is working, which is done by listing assignments.

Answer

az policy state list --resource-group myResourceGroup

Answer

az policy definition list --subscription 12345678-1234-1234-1234-123456789abc

Answer

az policy event list --subscription 12345678-1234-1234-1234-123456789abc

Question 9

Your company is deploying Microsoft Entra ID Governance and needs to ensure that guest users' access to internal applications expires after 90 days. Which feature should you configure?

Accepted Answer

Entitlement management. Entitlement management in Microsoft Entra ID Governance allows you to create access packages that govern guest user access to internal applications. You can configure an access package with a specific expiration policy, such as setting the access to expire after 90 days, ensuring automatic removal of guest access without manual intervention.

Answer

Privileged Identity Management (PIM)

Answer

Access reviews

Answer

Conditional Access policies

Question 10

Refer to the exhibit. You are a security administrator reviewing a custom Azure Policy assignment. The policy definition with ID 'abc123' is an initiative containing two policies: one that audits storage accounts with blob public access enabled and one that deploys a diagnostic setting for network security groups. The scope includes a production resource group. However, the compliance state shows 'Non-compliant' for several resources. What is the most likely reason for the non-compliance?

Accepted Answer

The diagnostic setting deployment policy requires a remediation task to bring non-compliant resources into compliance.. The policy that deploys a diagnostic setting for network security groups is a 'DeployIfNotExists' (DINE) policy. DINE policies do not automatically remediate existing non-compliant resources; they require a remediation task to be created and run, which will deploy the diagnostic settings to bring the resources into compliance. The audit-only policy for storage accounts does not require remediation, but the DINE policy's non-compliance indicates that the diagnostic settings are missing and need to be deployed via a remediation task.

Answer

The scope is incorrectly targeting the resource group, missing the subscription.

Answer

The audit policy is preventing the creation of storage accounts with public access.

Answer

The enforcement mode is set to 'Default' which disables policy evaluation.

Question 11

Your company is implementing a monitoring solution for Azure virtual machines. You need to collect performance counters and log events from the VMs and send them to a centralized Log Analytics workspace. Which agent should you install on the VMs?

Accepted Answer

Azure Monitor Agent. Azure Monitor Agent (AMA) is the current recommended agent for collecting performance counters and log events from Azure VMs and sending them to a Log Analytics workspace. It replaces the legacy Log Analytics agent (MMA) and offers centralized management via data collection rules (DCRs), improved security, and support for both Windows and Linux VMs. The AMA uses the Azure Monitor service pipeline and supports multi-homing to multiple workspaces natively.

Answer

Log Analytics agent (MMA)

Answer

Diagnostics Extension

Answer

Dependency Agent

Question 12

Refer to the exhibit. A user reports they cannot access a secret in the vault 'vault-prod'. The user has a Contributor role at the subscription scope and a Key Vault Secrets User role at the specific vault scope. What is the most likely reason for the failure?

Accepted Answer

The vault uses access policies instead of RBAC for authorization.. The user has the Key Vault Secrets User role at the vault scope, which grants read permissions to secrets via Azure RBAC. However, if the vault is configured to use access policies instead of RBAC for authorization, the RBAC role assignment is ignored. In that case, the user must be granted explicit permissions through the vault's access policy to read secrets. The Contributor role at subscription scope does not include data plane permissions for Key Vault secrets.

Answer

The user does not have write permissions on the vault.

Answer

The Key Vault Secrets User role does not allow reading secrets.

Answer

The scope of the Key Vault Secrets User role is incorrect.

Question 13

Your company uses Azure Resource Manager templates for infrastructure deployment. You need to ensure that all deployments are validated against organizational policies before resources are provisioned. Which Azure service should you use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it enforces organizational standards and assesses compliance at scale. It evaluates resources during deployment (via the ARM template deployment process) and can deny non-compliant resources before they are provisioned. Specifically, policies with a 'deny' effect block the deployment if the resource violates the policy, ensuring validation against organizational policies. This directly meets the requirement to validate deployments before resources are provisioned.

Answer

Azure RBAC

Answer

Management Groups

Answer

Azure Blueprints

Question 14

Your organization is implementing a hybrid identity solution with Microsoft Entra ID. Users in an on-premises Active Directory domain need to access cloud applications. You need to ensure that password changes on-premises are synchronized to Entra ID within 30 seconds. Which configuration should you use?

Accepted Answer

Microsoft Entra Cloud Sync. Microsoft Entra Cloud Sync (Option C) is the correct choice because it is designed for near-real-time synchronization of identity changes, including password writes, with a target latency of under 30 seconds. It uses the lightweight Microsoft Entra Connect provisioning agent and the SCIM (System for Cross-domain Identity Management) protocol to sync changes from on-premises Active Directory to Entra ID, meeting the strict 30-second requirement for password change propagation.

Answer

Pass-through Authentication (PTA)

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Connect Sync with password hash synchronization

Question 15

Refer to the exhibit. You are reviewing an ARM template for deploying a storage account. The template is missing the storage account name parameter definition. What will happen when you attempt to deploy this template?

Accepted Answer

The deployment will fail with a validation error because the parameter is not defined.. In Azure Resource Manager (ARM) templates, all parameters must be explicitly defined in the `parameters` section of the template. If a parameter is referenced (e.g., in the `resources` section) but not defined, the deployment fails with a validation error before any resource provisioning begins. This is because ARM validates the template structure and parameter definitions during the pre-deployment validation phase, and an undefined parameter is considered a syntax error.

Answer

The deployment will prompt the user to provide the missing parameter.

Answer

The deployment will succeed using a default name based on the resource group.

Answer

The deployment will create a storage account with a random name.