AZ-305 Design identity, governance, and monitoring solutions Practice Test 14 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel for security monitoring. You need to create a rule that triggers an incident when a user from a specific IP address performs more than 10 failed sign-ins within an hour. Which rule type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a custom KQL query that counts failed sign-in events from a specific IP address over a 1-hour window and triggers an incident when the count exceeds 10. This rule type is designed for user-defined detection logic based on log data, such as SigninLogs, and supports aggregation and threshold-based alerting.

Answer

Microsoft Security rule

Answer

Anomaly detection rule

Answer

Fusion rule

Question 2

You are designing a monitoring solution for a hybrid environment with on-premises servers and Azure VMs. You need to collect performance data from all servers and visualize it in a single dashboard. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a unified platform for collecting, analyzing, and visualizing performance data from both on-premises servers and Azure VMs. By deploying the Azure Monitor agent on all servers, you can send metrics and logs to a single Log Analytics workspace and then use Azure Workbooks or Metrics Explorer to create a consolidated dashboard.

Answer

Azure Service Health

Answer

Azure Workbooks

Answer

Azure Arc

Question 3

You are a solutions architect for a financial services company. The company uses Microsoft Entra ID and has the following requirements:
1. All Azure administrators must use Privileged Identity Management (PIM) to activate their roles for a maximum of 4 hours.
2. Activation must require Azure Multi-Factor Authentication (MFA) and a ticket number.
3. Approvers must be notified via email when a role is activated.
4. All activation requests must be audited.
You configure PIM for Entra ID roles. Which additional configuration is needed to meet all requirements?

Accepted Answer

Set the maximum activation duration to 4 hours in the PIM settings.. PIM for Entra ID roles already supports MFA, ticket numbers, email notifications, and audit logs. However, the requirement to limit activation to 4 hours requires configuring a maximum activation duration in PIM settings. Option A (Conditional Access) is not needed because PIM handles MFA separately. Option B (Azure AD audit logs) is already enabled. Option D (Azure Monitor) is not required for this scenario.

Answer

Configure a Conditional Access policy to require MFA for all admins.

Answer

Enable Azure AD audit logs in the Azure portal.

Answer

Create an Azure Monitor alert rule for role activations.

Question 4

Your company is migrating on-premises applications to Azure. The identity team wants to synchronize on-premises Active Directory Domain Services (AD DS) to Microsoft Entra ID. You need to recommend a solution that ensures users can authenticate with their corporate credentials and that password changes are synchronized immediately. What should you recommend?

Accepted Answer

Microsoft Entra Connect with password hash synchronization (PHS). Password hash synchronization (PHS) is the correct choice because it synchronizes password hashes from on-premises AD DS to Microsoft Entra ID, enabling immediate password change synchronization. This ensures users can authenticate with their corporate credentials without requiring additional infrastructure like federation servers, and password changes are propagated in near real-time (typically within minutes).

Answer

Microsoft Entra Connect with federation (AD FS)

Answer

Microsoft Entra Connect with pass-through authentication (PTA)

Answer

Microsoft Entra Connect with cloud sync

Question 5

A company uses Azure Policy to enforce tagging on resources. The security team reports that some resources are missing the required 'CostCenter' tag. You need to ensure that any resource created without the required tag is automatically remediated by adding the tag with a default value. What should you configure in Azure Policy?

Accepted Answer

DeployIfNotExists effect. The DeployIfNotExists effect is correct because it automatically remediates non-compliant resources by deploying a tag with a default value when the required 'CostCenter' tag is missing. This effect triggers a deployment task that adds the tag, ensuring continuous compliance without manual intervention.

Answer

AuditIfNotExists effect

Answer

Append effect

Answer

Deny effect

Question 6

You are tasked with ensuring that all VMs in the subscription have Azure Hybrid Benefit enabled for Windows Server. You create the Azure Policy shown in the exhibit. However, after assignment, the compliance report shows that some D-series VMs are still non-compliant. What is the most likely cause?

Accepted Answer

The policy does not apply to existing resources; it only blocks new or updated ones.. Azure Policy with the 'deny' effect only blocks new or updated resources that violate the policy; it does not automatically remediate existing non-compliant resources. The D-series VMs were likely created before the policy was assigned, so they remain non-compliant until they are redeployed or a remediation task is triggered. To enforce compliance on existing resources, you would need to use a 'deployIfNotExists' or 'modify' effect with a remediation task.

Answer

The 'deny' effect is incorrectly configured; it should be 'audit' to show compliance.

Answer

The 'like' operator does not match standard D-series SKUs.

Answer

The policy is scoped to a management group that excludes the resource group containing the VMs.

Question 7

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. You need to ensure that all Azure subscriptions are covered by a single continuous export configuration that sends security alerts to a Log Analytics workspace. What should you do?

Accepted Answer

Configure continuous export at the management group level.. Continuous export can be configured at the subscription level or management group scope. By configuring it at the management group level, all subscriptions under that management group inherit the export settings. This provides a single configuration point.

Answer

Use Azure Policy to deploy continuous export settings to all subscriptions.

Answer

Create an Azure Automation runbook to export settings to all subscriptions.

Answer

Configure continuous export in each subscription individually.

Question 8

Your company is designing a monitoring solution for a critical line-of-business application running on multiple Azure VMs. The application emits custom performance counters. You need to ingest these counters into Azure Monitor Metrics and create a metric alert when the average value exceeds a threshold over 5 minutes. The solution must minimize latency between counter emission and alert firing. What should you use?

Accepted Answer

Azure Monitor agent to collect counters and send to Azure Monitor Metrics, then create a metric alert.. The Azure Monitor agent is the correct choice because it can collect custom performance counters and send them directly to Azure Monitor Metrics, which supports near-real-time metric alerts with low latency. This minimizes the delay between counter emission and alert firing, meeting the requirement for a 5-minute evaluation window.

Answer

Application Insights agent to collect counters and send to Application Insights, then create a metric alert.

Answer

Log Analytics agent to collect counters and send to a Log Analytics workspace, then create a log alert.

Answer

Azure Diagnostics extension to collect counters and send to Azure Storage, then use Azure Monitor Metrics from storage.

Question 9

You need to provide a team of developers with access to create and manage Azure resources in a specific resource group. The developers should not be able to modify access policies for other users. Which built-in role should you assign?

Accepted Answer

Contributor. The Contributor role allows full management of resources but cannot manage access (role assignments). Owner can manage access. Reader is read-only. User Access Administrator only manages access, not resources.

Answer

Owner

Answer

Reader

Answer

User Access Administrator

Question 10

Your organization uses Microsoft Sentinel for security monitoring. You need to create a rule that triggers an incident when a user from a specific IP address performs more than 10 failed sign-ins within an hour. Which rule type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Microsoft Sentinel analytics rule using the Azure Activity data connector.. Microsoft Sentinel's Azure Activity data connector ingests resource logs from Azure's control plane (Azure Resource Manager). By creating an analytics rule that detects a 'Microsoft.Compute/virtualMachines/write' operation with a network security group rule allowing inbound SSH (port 22) from 'Internet' (any IP), you can generate an alert without deploying additional agents or infrastructure. This minimizes administrative overhead by using existing Sentinel resources and the built-in Activity log connector.

Answer

Create an Azure Policy with audit effect and configure a Sentinel data connector for Azure Policy.

Answer

Create an Azure Monitor metric alert on the 'Network In' metric.

Answer

Enable Microsoft Defender for Cloud and configure a continuous export to Sentinel.

Question 11

You are investigating a security incident where an unauthorized user may have modified a production VM. You run the KQL query shown in the exhibit in Microsoft Sentinel, but it returns no results. The VMs are present and have been modified recently. What is the most likely reason for no results?

Accepted Answer

The ResourceId contains the VM name in lowercase, but the extract pattern is case-sensitive.. The KQL query uses the `extract` function with a pattern that expects the VM name in the ResourceId to be in lowercase, but the actual ResourceId contains the VM name in uppercase. The `extract` function in KQL is case-sensitive by default, so the pattern fails to match, returning no results. Even though the VMs have been modified, the query cannot parse the ResourceId correctly, leading to zero output.

Answer

The query does not filter by a time range, so it may be returning old data.

Answer

The Caller field is not included in the output, so the query cannot identify unauthorized users.

Answer

The OperationNameValue is incorrect; the correct value is 'MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE' in uppercase.

Question 12

Your company is planning to use Azure Monitor Workbooks to create custom dashboards for IT operations. You need to select the data sources that can be used in a workbook. Which TWO data sources are supported? (Choose two.)

Accepted Answer

Azure Resource Graph. Azure Monitor Workbooks support Azure Resource Graph as a data source, allowing you to query Azure resources and their properties across subscriptions. This enables rich, resource-centric visualizations in custom dashboards without needing to export data to a separate store.

Answer

Azure SQL Database

Answer

Microsoft Sentinel

Answer

Azure Blob Storage

Question 13

Your organization has multiple Azure subscriptions and uses Azure Blueprints to enforce governance. You need to design a blueprint that includes role assignments, policy assignments, and resource groups. Which THREE components can be included in an Azure Blueprint? (Choose three.)

Accepted Answer

Role assignments. Azure Blueprints allow you to define a repeatable set of Azure resources that adhere to your organization's standards, patterns, and requirements. Role assignments (B) are a core artifact that can be included to grant specific Azure RBAC roles at the blueprint scope, ensuring consistent access control. Policy assignments (C) are also a native blueprint artifact, enabling you to enforce compliance rules across the environment. ARM templates (E) can be included as an artifact to deploy infrastructure as code, making them a valid component of a blueprint definition.

Answer

Management group

Answer

Subscription

Question 14

Your company uses Microsoft Entra ID. You need to implement a governance strategy for guest users. Which TWO actions should you take? (Choose two.)

Accepted Answer

Create access reviews for guest users. Access reviews for guest users (Option A) are a core governance control in Microsoft Entra ID, allowing administrators to periodically review and confirm or revoke guest access. This ensures that guest accounts remain necessary and compliant with security policies, directly addressing the governance requirement.

Answer

Disable external identities

Answer

Block all guest user access

Answer

Enable self-service sign-up for guest users

Question 15

You are a cloud architect for a multinational corporation. The company has a single Azure tenant with a management group hierarchy: Root MG -> Corp MG -> (Finance, HR, IT, Marketing) child management groups. Each child management group contains multiple subscriptions. The IT governance team wants to enforce a policy that all Azure resources must have a 'CostCenter' tag. However, the Finance department has legacy resources that cannot be modified and must be exempt from this policy. You need to design a solution that meets the following requirements: (1) The policy should be applied to all subscriptions in the Corp MG except those in the Finance MG. (2) The policy should audit non-compliant resources but not deny them. (3) The solution must use Azure Policy and minimize administrative overhead. What should you do?

Accepted Answer

Assign the policy at the Corp management group scope and exclude the Finance management group.. Assigning the policy at the Corp management group scope and excluding the Finance management group meets all requirements: it applies the policy to all subscriptions under Corp (including Finance, HR, IT, Marketing) while the exclusion removes Finance from policy evaluation. Using the 'audit' effect ensures non-compliant resources are flagged but not denied, and this single assignment minimizes administrative overhead.

Answer

Assign the policy at the Root management group and exclude all child management groups except Corp.

Answer

Assign the policy at each child management group except Finance.

Answer

Assign the policy to each subscription individually, excluding those in Finance.