AZ-305 Design identity, governance, and monitoring solutions Practice Test 13 — 15 Questions

Question 1

You are troubleshooting access for a user named John Doe. The exhibit shows the output of Get-AzRoleAssignment. John reports he cannot create virtual machines in the Prod resource group. Other users with the same role can create VMs. What is the most likely cause?

Accepted Answer

John has a deny assignment that prevents VM creation. The correct answer is C because Azure RBAC supports deny assignments that explicitly block specific actions even if the user has an allow assignment like Contributor. Since other users with the same role can create VMs, John's role assignment is not the issue; a deny assignment at a higher scope (e.g., management group or subscription) or directly on the resource group is overriding the allow, preventing VM creation. This is a common troubleshooting scenario where a deny assignment is the root cause.

Answer

John does not have multi-factor authentication enabled

Answer

John is not assigned the Contributor role

Answer

The role assignment is at the wrong scope

Question 2

Your organization uses Microsoft Purview for data governance. You need to classify sensitive data in Azure SQL Database and automatically apply sensitivity labels. What should you configure?

Accepted Answer

Microsoft Purview Data Map with scanning and labeling. Microsoft Purview Data Map with scanning and labeling is the correct solution because it integrates with Azure SQL Database to automatically scan for sensitive data types (e.g., credit card numbers, social security numbers) and apply sensitivity labels defined in Microsoft Purview Information Protection. This native integration uses the Purview scanning infrastructure to classify data at rest and propagate labels directly to the SQL database, meeting the requirement for automated classification and labeling.

Answer

Azure Information Protection scanner

Answer

Microsoft Sentinel with a workbook

Answer

Azure Policy with built-in SQL classification policy

Question 3

Which TWO actions should you take to implement a least-privilege identity strategy for Azure resources?

Accepted Answer

Use managed identities for Azure resources instead of service principals with secrets. Managed identities for Azure resources eliminate the need to manage credentials by automatically rotating them and binding them to a resource lifecycle. This removes the risk of secret leakage or mismanagement that exists with service principal secrets, directly supporting a least-privilege identity strategy by ensuring identities are scoped and ephemeral.

Answer

Assign the Contributor role at the subscription scope to allow flexibility

Answer

Use storage account keys for access to blob data

Answer

Use a single service principal for all applications

Question 4

Which THREE components are required to monitor and audit Azure resource changes using Azure Monitor?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is required because it serves as the central repository where Azure Monitor collects and stores log data from various sources, including diagnostic settings and activity logs. Without a workspace, there is no destination for the logs to be ingested, queried, or analyzed, making it an essential component for monitoring and auditing resource changes.

Answer

An Application Insights resource

Answer

Azure Policy with audit effect

Question 5

Which TWO Microsoft Entra ID features should you use to protect against credential attacks?

Accepted Answer

Password Protection. Password Protection is correct because it specifically targets credential attacks by blocking weak passwords and common variations (e.g., 'Password123!') using a global banned password list and the option to add custom terms. Identity Protection is correct because it uses real-time risk detection (e.g., leaked credentials, anonymous IP addresses) to automatically block or require MFA for suspicious sign-ins, directly mitigating credential-based attacks like password spray or brute force.

Answer

Group-based licensing

Answer

Self-Service Password Reset (SSPR)

Answer

Application Proxy

Question 6

Which THREE Azure services or features should you use to design a comprehensive monitoring solution for a hybrid infrastructure spanning on-premises and Azure?

Accepted Answer

Azure Monitor. Azure Monitor is the central platform for collecting, analyzing, and acting on telemetry from both Azure and on-premises resources. It provides a unified monitoring experience by aggregating metrics and logs, enabling alerting, dashboards, and integration with other services like Log Analytics. For a hybrid infrastructure, Azure Monitor serves as the core data ingestion and analysis hub, making it essential for a comprehensive monitoring solution.

Answer

Network Watcher

Answer

Azure Traffic Manager

Question 7

Which TWO Azure Policy effects can be used to prevent the creation of non-compliant resources?

Accepted Answer

Deny. The 'Deny' effect (Option C) is correct because it actively blocks any resource creation or update request that violates a policy rule, ensuring non-compliant resources are never deployed. The 'Modify' effect (Option D) is also correct because it can add or change resource properties during creation or update to enforce compliance, effectively preventing non-compliant configurations from being created. Both effects operate at the time of the resource request, stopping non-compliant resources before they exist.

Answer

Audit

Answer

Append

Answer

Manual

Question 8

Which THREE methods can you use to authenticate users to Azure resources using Microsoft Entra ID?

Accepted Answer

OAuth 2.0 authorization code flow. OAuth 2.0 authorization code flow is correct because it is the primary delegated authentication protocol used by Microsoft Entra ID to authenticate users to Azure resources. This flow allows a client application to obtain an access token on behalf of a user, after the user has authenticated interactively via the Microsoft identity platform. It supports single sign-on (SSO), multi-factor authentication, and conditional access policies, making it the standard for user authentication in Azure.

Answer

API keys

Answer

Shared access signatures (SAS) tokens

Question 9

Your company is migrating on-premises applications to Azure. You need to ensure that users can sign in using their existing on-premises Active Directory credentials without duplicating accounts. Which identity solution should you recommend?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (formerly Azure AD Connect) is the correct solution because it synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to sign in with their existing credentials via password hash synchronization, pass-through authentication, or federation. This avoids duplicating accounts by maintaining a single identity source of truth, with optional seamless single sign-on (SSO) for a transparent experience.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra External ID

Answer

Microsoft Entra Domain Services

Question 10

You are designing a governance strategy for a new Azure subscription. The security team requires that all resources must have a 'CostCenter' tag and an 'Environment' tag. Which Azure policy effect should you use to automatically apply the tags to new resources?

Accepted Answer

modify. The 'modify' effect is correct because it can automatically append or replace missing tags on new or existing non-compliant resources during resource creation or update. Unlike 'deployIfNotExists', which only runs remediation tasks after creation, 'modify' applies the tags inline as part of the resource creation request, ensuring compliance without requiring a separate remediation task.

Answer

audit

Answer

deny

Answer

deployIfNotExists

Question 11

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to implement a lifecycle workflow that automatically disables user accounts when employees leave the organization, and then deletes them after 30 days. What should you use?

Accepted Answer

Microsoft Entra ID Governance. Microsoft Entra ID Governance includes lifecycle workflows that automate the process of disabling and deleting user accounts based on triggers such as employee departure. This feature allows you to configure a workflow that disables the account immediately and then schedules deletion after a specified period, such as 30 days, without requiring custom scripting or manual intervention.

Answer

Microsoft Entra Domain Services

Answer

Microsoft Intune

Answer

Microsoft Entra Connect Health

Question 12

You need to configure a monitoring solution for Azure virtual machines that collects performance counters, event logs, and enables alerting based on CPU usage exceeding 90%. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a unified platform for collecting performance counters and event logs from Azure VMs via the Log Analytics agent or Azure Monitor Agent, and it supports metric-based alert rules that can trigger when CPU usage exceeds a defined threshold (e.g., 90%). This directly meets the requirements for monitoring, log collection, and alerting without additional services.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Update Manager

Question 13

Your company uses Microsoft Entra ID and has a custom application that requires users to have specific roles assigned. You need to ensure that role assignments are reviewed quarterly and automatically remove assignments that are not approved. Which feature should you use?

Accepted Answer

Microsoft Entra ID Governance access reviews. Microsoft Entra ID Governance access reviews enable you to create recurring reviews of role assignments, with automatic removal of assignments that reviewers do not approve. This directly meets the requirement for quarterly reviews and automatic removal of unapproved assignments, making it the correct choice.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 14

Refer to the exhibit. You assign this Azure Policy to a management group. A user creates a new virtual machine without any tags. What will happen?

Accepted Answer

The virtual machine is created with the 'Environment' tag automatically added.. The Azure Policy in the exhibit uses the 'DeployIfNotExists' effect, which automatically deploys a tag (e.g., 'Environment') to resources that lack it during creation or update. Since the policy is assigned at the management group level, it applies to all child subscriptions and resources, including new virtual machines. When a user creates a VM without tags, the policy evaluates the resource and adds the missing tag without denying the creation or requiring manual intervention.

Answer

The policy is not evaluated because the resource is new.

Answer

The virtual machine creation is denied.

Answer

The virtual machine is created without the tag, and a compliance alert is generated.

Question 15

You need to monitor the sign-in activities of users in Microsoft Entra ID and detect risky sign-ins, such as those from anonymous IP addresses. Which service should you use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct service because it is specifically designed to detect and respond to risky sign-in activities, including sign-ins from anonymous IP addresses, using machine learning-based risk detection policies. It integrates directly with Microsoft Entra ID to evaluate sign-in risk in real time and can automatically block or require multi-factor authentication based on configured risk thresholds.

Answer

Microsoft Defender XDR

Answer

Azure Monitor

Answer

Microsoft Sentinel

AZ-305 Design identity, governance, and monitoring solutions Practice Test 13 — 15 Questions

Exhibit

AZ-305 Design identity, governance, and monitoring solutions Practice Test 13 — 15 Questions

Exhibit