AZ-305 Design identity, governance, and monitoring solutions Practice Test 14 — 15 Questions

Question 1

Your company has multiple Azure subscriptions. You need to create a single query that aggregates resource utilization metrics across all subscriptions and visualizes them in a dashboard. Which combination of Azure services should you use?

Accepted Answer

Azure Resource Graph and Azure Monitor Workbooks. Azure Resource Graph (ARG) can query across multiple subscriptions, resource groups, and resource types in a single query, making it ideal for aggregating utilization metrics. Azure Monitor Workbooks then provide a flexible, interactive canvas to visualize those query results in a dashboard, supporting rich visualizations and parameterized inputs.

Answer

Azure Monitor Log Analytics workspace and Azure Dashboards

Answer

Azure Policy and Azure Monitor Alerts

Answer

Microsoft Sentinel and Azure Playbooks

Question 2

Your organization uses Microsoft Entra ID and requires that all external users invited via B2B collaboration must authenticate using multi-factor authentication (MFA). You need to enforce this for all guest users. What should you configure?

Accepted Answer

Microsoft Entra Conditional Access policy. Option D is correct because Conditional Access policies in Microsoft Entra ID allow you to enforce MFA for guest users by targeting the 'Guest or external users' identity type and requiring MFA as a grant control. This provides granular control over authentication requirements for B2B collaboration users, unlike the other options which either lack enforcement capability or apply to different scenarios.

Answer

Microsoft Entra B2B collaboration settings

Answer

Microsoft Entra Identity Protection user risk policy

Answer

Microsoft Entra ID MFA registration policy

Question 3

Which TWO actions should you take to ensure that only authorized users can access sensitive data stored in Azure Blob Storage? (Choose two.)

Accepted Answer

Configure Azure RBAC roles to grant access to specific users.. Azure RBAC roles allow you to grant granular permissions to specific users or groups, ensuring that only authorized identities can access sensitive data in Blob Storage. By assigning built-in roles like 'Storage Blob Data Reader' or 'Storage Blob Data Contributor', you enforce identity-based access control at the storage account, container, or blob level. This directly addresses the requirement of restricting access to authorized users.

Answer

Configure firewall rules to allow only specific IP addresses.

Answer

Enable blob versioning.

Answer

Enable soft delete for blobs.

Question 4

Which THREE conditions should be met to implement a successful Azure landing zone for a new enterprise subscription? (Choose three.)

Accepted Answer

A management group hierarchy that separates environments.. A management group hierarchy that separates environments (e.g., production, non-production, and management) is a core design principle of an Azure landing zone. It enables policy inheritance, role-based access control (RBAC) isolation, and cost tracking across different workloads, aligning with the Cloud Adoption Framework's governance best practices.

Answer

A dedicated Azure Active Directory tenant.

Answer

Microsoft Sentinel enabled for security monitoring.

Question 5

Which TWO features of Microsoft Entra ID help protect against credential compromise? (Choose two.)

Accepted Answer

Microsoft Entra Password Protection. Options A and D are correct. Password protection bans weak passwords and smart lockout prevents brute force attacks. Option B is wrong because Conditional Access controls access after authentication. Option C is wrong because Identity Protection detects risky sign-ins but does not directly protect against credential compromise. Option E is wrong because access reviews are for governance.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra access reviews

Question 6

Refer to the exhibit. You run this PowerShell script in an Azure subscription. The script executes successfully. What is the outcome?

Accepted Answer

All resources without tags get the tag 'Environment' with value 'Unknown'.. The `Update-AzTag` cmdlet with the `-Operation Merge` parameter merges the specified tags into existing resource tags without removing any existing tags. When a resource already has tags, only the specified tag is added or updated; when a resource has no tags, the specified tag is applied. This matches option B: all resources without tags get the tag 'Environment' with value 'Unknown'.

Answer

All existing tags are replaced with 'Environment'='Unknown'.

Answer

All resources in the subscription get the tag 'Environment' with value 'Unknown'.

Answer

The script fails because Update-AzTag does not support merge.

Question 7

Refer to the exhibit. You deploy this ARM template to create an Azure Monitor Workbook. The template deploys successfully. What will the workbook display?

Accepted Answer

CPU utilization averaged over 5-minute intervals.. The ARM template configures an Azure Monitor Workbook to query the `InsightsMetrics` table for the `cpu_usage_percentage` metric, which is collected by Azure Monitor Agent (AMA) at a default granularity of 1 minute. The workbook uses the `avg` aggregation and a time grain of `5m` (5 minutes) in the query, so it displays CPU utilization averaged over 5-minute intervals. The `summarize` operator with `bin(TimeGenerated, 5m)` explicitly groups data into 5-minute buckets, making option B correct.

Answer

CPU utilization averaged over 1-hour intervals.

Answer

Memory utilization over time.

Answer

Disk I/O utilization over time.

Question 8

Refer to the exhibit. You assign this Azure Policy to a resource group. A user attempts to create a new Azure SQL Server without specifying an administrator login. What will happen?

Accepted Answer

The SQL Server creation is denied.. The Azure Policy assigned to the resource group includes a condition that checks if the 'administratorLogin' property is missing or null when creating a SQL Server. Since the user does not specify an administrator login, the condition evaluates to true, triggering the 'deny' effect. This prevents the creation of the SQL Server entirely, as Azure Policy enforces compliance before the resource is provisioned.

Answer

The SQL Server is created with a default administrator login.

Answer

The policy is ignored because the condition is not met.

Answer

The SQL Server is created but a compliance alert is generated.

Question 9

Your company has a Microsoft Entra ID tenant with 50,000 users. You need to design a solution to ensure that users can reset their own passwords without help desk intervention, while preventing password reuse for the last 10 passwords. Which feature should you enable?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without help desk intervention. Additionally, SSPR can be configured with password protection policies that enforce password history, preventing reuse of the last 10 passwords. This directly meets both requirements stated in the question.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Connect

Answer

Privileged Identity Management (PIM)

Question 10

You are designing a monitoring solution for a critical application hosted on Azure Virtual Machines. The application experiences intermittent high CPU usage that lasts for 10 minutes. You need to be notified within 5 minutes of the start of each occurrence. The solution must minimize false alerts. What should you use?

Accepted Answer

Azure Monitor metric alert with a dynamic threshold and 5-minute frequency, alert on 2 consecutive breaches. Option C is correct because it uses a dynamic threshold that adapts to normal CPU patterns, reducing false alerts, and the 5-minute frequency with a requirement for 2 consecutive breaches ensures that the 10-minute event is detected within 5 minutes of its start (since the first breach triggers the second evaluation after 5 minutes, and if the second consecutive breach occurs, the alert fires). This matches the requirement for notification within 5 minutes while minimizing false positives.

Answer

Azure Monitor log alert querying Perf table every 1 minute

Answer

Create an Azure Monitor action group that sends email

Answer

Azure Monitor metric alert with a static threshold of 90% CPU

Question 11

Your company uses Microsoft Entra ID for identity management. You need to ensure that only devices compliant with your company's security policies can access corporate resources. Which solution should you implement?

Accepted Answer

Conditional Access with device compliance policies from Microsoft Intune. Conditional Access in Microsoft Entra ID allows you to enforce access controls based on conditions, including device compliance. By integrating with Microsoft Intune, you can define device compliance policies (e.g., requiring encryption, a minimum OS version, or anti-malware status) and then configure a Conditional Access policy to block or grant access only to devices that are marked as compliant. This directly ensures that only compliant devices can access corporate resources.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Sentinel

Answer

Microsoft Defender XDR

Question 12

You are designing a governance strategy for an Azure environment that includes multiple subscriptions. The security team requires that all storage accounts must have HTTPS traffic only. Any non-compliant storage account must be automatically remediated. What is the most efficient solution?

Accepted Answer

Use Azure Policy with a DeployIfNotExists effect to enable HTTPS-only traffic. Option C is correct because Azure Policy with a DeployIfNotExists effect can automatically remediate non-compliant storage accounts by enabling the 'HTTPS traffic only' property. This approach ensures continuous compliance without manual intervention, meeting the security team's requirement for automatic remediation.

Answer

Create an Azure Blueprint that includes a policy initiative

Answer

Assign a custom RBAC role that denies creation of storage accounts without HTTPS

Answer

Configure Azure Monitor alerts to notify the security team

Question 13

Your organization uses Microsoft Entra ID and Azure Key Vault. You need to ensure that a custom application can securely access secrets in Key Vault without storing credentials in code. The application runs on an Azure Virtual Machine. What should you use?

Accepted Answer

Assign a system-assigned managed identity to the VM. Option C is correct because a system-assigned managed identity for Azure Virtual Machines allows the application to authenticate to Azure Key Vault without storing any credentials in code. Azure automatically manages the identity's lifecycle and tokens, enabling the VM to obtain an access token from Azure AD (now Microsoft Entra ID) to call Key Vault's REST API. This aligns with the principle of zero-trust and eliminates the need for service principals or certificates in the application.

Answer

Store the Key Vault URL and connection string in the application configuration

Answer

Create a service principal and upload a certificate to the VM

Answer

Use a shared access signature (SAS) token

Question 14

Refer to the exhibit. You are reviewing an Azure Resource Manager deployment configuration. The deployment is failing with a conflict error. What is the most likely cause?

Accepted Answer

The debugSetting includes requestContent, which may cause the request to exceed size limits. The correct answer is C because including `requestContent` in the `debugSetting` property of an ARM template deployment causes the entire HTTP request payload to be logged. For large templates or parameter files, this can exceed the Azure Resource Manager API request size limit (typically 4 MB), resulting in a conflict error (HTTP 409) as the service rejects the oversized request.

Answer

The deployment mode is Incremental instead of Complete

Answer

The template is not parameterized

Answer

The onError property is set to DeploymentRollback

Question 15

Your company uses Microsoft Sentinel for security monitoring. You need to design a solution to analyze sign-in logs and detect patterns of anomalous access from different geographical locations within a short time frame. Which feature should you use?

Accepted Answer

Kusto Query Language (KQL) queries. C is correct because Kusto Query Language (KQL) queries are the native query language used in Microsoft Sentinel to perform deep analysis of log data, including sign-in logs. To detect patterns of anomalous access from different geographical locations within a short time frame, you would write a KQL query that aggregates sign-in events by user, timestamp, and location, then applies threshold-based logic (e.g., multiple distinct countries within 10 minutes) to surface the anomaly. This is a custom detection scenario that requires direct querying of the Log Analytics workspace, which KQL enables.

Answer

Microsoft Sentinel Analytics Rules

Answer

Microsoft Sentinel Playbooks

Answer

Microsoft Sentinel Workbooks