AZ-305 Design identity, governance, and monitoring solutions Practice Test 13 — 15 Questions

Question 1

Which TWO features of Microsoft Entra ID can be used to secure hybrid identities?

Accepted Answer

Seamless Single Sign-On. Seamless Single Sign-On (Seamless SSO) automatically signs users in when they are on corporate devices connected to the corporate network, eliminating password prompts. Password Hash Synchronization (PHS) synchronizes a hash of the user's on-premises AD password to Azure AD, enabling cloud authentication without additional infrastructure. Both features directly secure hybrid identities by extending on-premises credentials to the cloud.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Azure Active Directory Domain Services

Question 2

Refer to the exhibit. You are reviewing the output of an Azure Key Vault secret listing command. The application team reports that a secret is not accessible. What is the most likely reason?

Accepted Answer

The secret has expired. The secret listing output shows an 'expires' field with a date in the past, indicating the secret has expired. Azure Key Vault enforces expiration by preventing access to secrets whose expiration date has passed, returning a 403 Forbidden error. This is the most likely reason the application cannot access the secret.

Answer

The secret is tagged as production but the application is in development

Answer

The Key Vault is in a soft-deleted state

Answer

The secret is disabled

Question 3

Refer to the exhibit. You are reviewing an Azure Policy definition. Which virtual machines will be denied?

Accepted Answer

All virtual machines except those with SKU Standard_DS2_v2. The Azure Policy definition uses a 'deny' effect with a condition that checks if the virtual machine's SKU field is not equal to 'Standard_DS2_v2'. This means any VM whose SKU does not match 'Standard_DS2_v2' will be denied. Only VMs with the exact SKU 'Standard_DS2_v2' will be allowed, making option D correct.

Answer

No virtual machines because the condition is invalid

Answer

All virtual machines regardless of SKU

Answer

Only virtual machines with SKU Standard_DS2_v2

Question 4

Refer to the exhibit. You are reviewing a KQL query in Microsoft Sentinel. The query returns no results. Which is the most likely cause?

Accepted Answer

Microsoft Entra ID Protection is not enabled for the tenant. The KQL query references the 'IdentityLogonEvents' table, which is populated by Microsoft Entra ID Protection. If Entra ID Protection is not enabled, this table will contain no data, causing the query to return zero results even if the syntax, column names, and time range are correct.

Answer

The syntax is invalid because where clause should use == instead of ==

Answer

The column names are incorrect

Answer

The time range is too short

Question 5

You are designing a governance solution for a Microsoft Azure environment that contains multiple subscriptions. You need to ensure that all resources are compliant with corporate security policies. The solution must automatically remediate non-compliant resources. What should you include in the design?

Accepted Answer

Azure Policy with DeployIfNotExists effect. Azure Policy with the DeployIfNotExists effect is the correct choice because it automatically remediates non-compliant resources by triggering a deployment (e.g., via a template) when a resource is created or updated and does not meet the policy condition. This ensures continuous compliance with corporate security policies without manual intervention, as the effect can also be assigned a remediation task to fix existing resources.

Answer

Azure RBAC custom roles

Answer

Azure Resource Graph queries

Answer

Azure Blueprints

Question 6

Refer to the exhibit. You are implementing an Azure Policy to control VM SKU deployment. You assign this policy to a subscription. A developer attempts to deploy a virtual machine with SKU Standard_DS2_v2. What is the outcome?

Accepted Answer

The deployment is denied.. The Azure Policy in the exhibit uses a 'deny' effect, which explicitly blocks any deployment that does not match the allowed VM SKUs. Since Standard_DS2_v2 is not in the allowed list, the policy engine evaluates the request during deployment and rejects it before any resource is created. This results in the deployment being denied entirely, not just audited or flagged.

Answer

The deployment is audited and logged.

Answer

The deployment is allowed.

Answer

The VM is deployed but flagged as non-compliant.

Question 7

Your company requires that all administrative actions in Azure subscriptions be logged and retained for seven years. Which service should you use to collect and store these logs?

Accepted Answer

Azure Activity Log. The Azure Activity Log (now part of Azure Monitor) records all control-plane operations (create, update, delete) on Azure resources and can be retained for up to seven years by configuring a diagnostic setting to stream the logs to a Log Analytics workspace or Azure Storage. This meets the requirement for logging and long-term retention of administrative actions.

Answer

Azure Monitor Metrics

Answer

Azure Resource Health

Answer

Microsoft Entra ID audit logs

Question 8

You are designing a monitoring solution for a critical application running on Azure virtual machines. The application must maintain an SLA of 99.99% uptime. You need to be notified within five minutes if any VM becomes unavailable. What should you configure?

Accepted Answer

Azure Monitor VM Insights with availability metric alerts. VM Insights with availability metric alerts monitors the heartbeat of Azure VMs and triggers an alert within five minutes if a VM becomes unavailable. This directly supports the 99.99% SLA requirement by enabling rapid notification of downtime, using the 'VM Availability Metric (Preview)' which tracks the VM's running state via the Azure Resource Health provider.

Answer

Log Analytics workspaces

Answer

Azure Advisor recommendations

Answer

Azure Service Health alerts

Question 9

You are designing an identity solution for a multinational company that uses Microsoft Entra ID. The company has a requirement that all users must authenticate using biometrics or FIDO2 security keys. Which Entra ID feature should you configure?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID allow you to enforce authentication strength requirements, such as requiring biometrics or FIDO2 security keys, by targeting specific user groups or applications. This is achieved by configuring a Conditional Access policy with the 'Require multifactor authentication' control and integrating with authentication methods like Windows Hello for Business or FIDO2 security keys, ensuring that only passwordless authentication methods meeting the company's biometric or FIDO2 requirement are permitted.

Answer

Passwordless authentication

Answer

Identity Protection

Answer

Entra Verified ID

Question 10

Which TWO actions can be performed using Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Manage access packages for internal and external users. Microsoft Entra ID Governance includes entitlement management, which allows administrators to create and manage access packages that bundle resources (like groups, apps, and SharePoint sites) and assign them to internal and external users. This enables automated lifecycle management of access, including expiration and renewal, making Option B correct.

Answer

Synchronize users from on-premises Active Directory

Answer

Configure network security group rules

Answer

Deploy virtual machines in Azure

Question 11

Which THREE components are required to implement a complete monitoring solution with Azure Monitor? (Choose three.)

Accepted Answer

Alert rules to notify on conditions. Alert rules (C) are a core component of a complete monitoring solution because they define conditions that trigger notifications or automated actions when monitored metrics or log data cross thresholds. Without alert rules, collected data remains passive and cannot proactively inform administrators of issues, making the solution incomplete.

Answer

Application Insights for every application

Answer

Azure Policy assignments

Question 12

Which TWO Microsoft Entra ID editions include Conditional Access? (Choose two.)

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1 includes Conditional Access, which allows organizations to enforce access policies based on signals like user, location, device, and application. This edition provides the core Conditional Access capabilities needed for most enterprise scenarios, such as requiring multi-factor authentication or blocking access from untrusted locations.

Answer

Azure AD Basic (legacy)

Answer

Microsoft 365 Business Basic

Answer

Microsoft Entra ID Free

Question 13

Which THREE Azure services can be used to monitor the performance of a web application? (Choose three.)

Accepted Answer

Application Insights. Application Insights is an Azure service specifically designed for monitoring the performance and usage of live web applications, collecting telemetry such as request rates, response times, and failure rates. Azure Monitor Metrics provides numerical performance data from Azure resources, including web apps, for real-time monitoring and alerting. Azure Monitor Logs collects and stores log data from multiple sources, enabling deep analysis of application performance and troubleshooting through queries. Together, these three services offer comprehensive performance monitoring for web applications.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 14

Which TWO features are part of Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Entitlement Management. The correct answers are A (Entitlement Management) and E (Access Reviews). Both are core features of Microsoft Entra ID Governance. Entitlement Management enables creation and management of access packages for internal and external users, while Access Reviews automate periodic recertification of group memberships and application access. Option B (Self-service password reset) is a user management feature, not governance. Option C (Conditional Access) is a security policy feature for access control. Option D (Privileged Identity Management) is also a governance feature but is not selected here; it is part of Identity Governance, not Identity Protection.

Answer

Self-service password reset

Answer

Conditional Access

Answer

Privileged Identity Management

Question 15

Which THREE are valid Azure RBAC role types? (Choose three.)

Accepted Answer

Service roles. Service roles, custom roles, and built-in roles are all valid Azure RBAC role types. Service roles are a specific category of built-in roles that grant permissions to Azure services (e.g., Virtual Machine Contributor). Custom roles allow you to define your own set of permissions when built-in roles don't meet your exact requirements. Built-in roles are predefined by Azure and cover common access scenarios (e.g., Owner, Contributor, Reader).

Answer

Directory roles

Answer

Guest roles