AZ-305 Design identity, governance, and monitoring solutions Practice Test 14 — 15 Questions

Question 1

Your organization uses Azure Monitor to collect metrics from Azure resources. You need to create a custom metric alert that triggers when the average CPU usage of a specific virtual machine exceeds 80% for 10 minutes. Which TWO components are required? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Metric alert rule. A metric alert rule is required because it defines the condition (average CPU > 80%) and the evaluation frequency (every 1 minute over a 10-minute aggregation window) that triggers the alert. Without the rule, Azure Monitor has no logic to evaluate the metric data and fire the alert.

Answer

Automation runbook

Answer

Log Analytics workspace

Answer

Diagnostic setting

Question 2

Your company is designing a governance strategy for Azure. You need to ensure that all resource groups in a subscription are created with a specific naming convention and mandatory tags. Which THREE services or features should you use together? (Choose three.)

Accepted Answer

Azure Blueprints. Azure Blueprints is correct because it enables the orchestrated deployment of Azure Policy, RBAC, and resource templates as a single composable artifact. By defining a blueprint that includes a policy for naming conventions and mandatory tags, you can enforce these requirements consistently across all resource groups within a subscription or management group hierarchy.

Answer

Azure RBAC

Answer

Resource Locks

Question 3

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to collect logs from on-premises firewalls and send them to Sentinel. Which TWO connectors can you use? (Choose two.)

Accepted Answer

Syslog. Syslog is a standard protocol for sending log messages from network devices, including firewalls, to a central collector. Common Event Format (CEF) is a syslog-based format that normalizes logs from different security products, making them easier to parse and analyze in Sentinel. Both connectors allow on-premises firewalls to forward their logs to a Log Analytics agent or AMA, which then sends them to Sentinel.

Answer

DNS

Answer

Azure Activity Log

Answer

Windows Security Events via AMA

Question 4

Your company uses Microsoft Entra ID. You need to implement a privileged identity management (PIM) strategy to secure administrative roles. Which TWO capabilities does PIM provide? (Choose two.)

Accepted Answer

Approval workflows for role activation. Privileged Identity Management (PIM) in Microsoft Entra ID provides time-based and approval-based role activation to secure privileged roles. Approval workflows for role activation (Option A) are a core PIM feature, allowing designated approvers to review and approve activation requests before a user gains elevated permissions. This ensures that privileged access is granted only after explicit authorization, reducing the risk of unauthorized use.

Answer

Conditional Access policies for role activation

Answer

Management of external identities

Answer

Automated user provisioning to applications

Question 5

Your organization uses Azure Monitor Logs to analyze application performance. You need to create a custom log query that calculates the 95th percentile of response times for a web app over the last 24 hours. Which THREE KQL functions should you use? (Choose three.)

Accepted Answer

percentile. Option A, percentile, is correct because it is the KQL aggregation function that computes the 95th percentile value of a numeric column such as response time. Option B, summarize, is correct because percentile must be invoked inside a summarize operator to group and aggregate the data over the desired window. Option E, where, is correct because it filters the dataset to the last 24 hours (for example, where TimeGenerated > ago(24h)) before aggregation. Option C, project, is not required since it only selects or renames columns and does not perform percentile calculation. Option D, sort, is not required because ordering rows does not contribute to computing a percentile aggregate.

Answer

project

Answer

sort

Question 6

Your company has multiple Azure subscriptions and needs a single pane of glass to monitor the health and performance of all resources across subscriptions. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct choice because it provides a unified, single-pane-of-glass experience for collecting, analyzing, and acting on telemetry from all Azure resources across multiple subscriptions. It aggregates metrics, logs, and alerts from various sources, enabling cross-subscription monitoring of health and performance without requiring separate tools.

Answer

Microsoft Sentinel

Answer

Azure Service Health

Answer

Azure Advisor

Question 7

You are reviewing a Conditional Access policy for a Microsoft Entra ID tenant. The exhibit shows the policy configuration. Users report that they are prompted for MFA every hour even when using approved Microsoft applications. The security team wants to reduce MFA prompts but maintain security. What should you modify?

Accepted Answer

Increase the signInFrequency value to 24 hours. The sign-in frequency control in Conditional Access determines how often a user must re-authenticate. Increasing the value from 1 hour to 24 hours directly reduces the frequency of MFA prompts while still requiring re-authentication daily, balancing security and user experience. This change applies to approved Microsoft applications as configured in the policy.

Answer

Enable 'persistentBrowser' session control

Answer

Change cloudAppSecurityType to 'blockDownloads'

Answer

Remove the 'approvedApplication' grant control

Question 8

Your organization uses Microsoft Azure and has a subscription with multiple resource groups. You need to ensure that only users in the Finance department can access storage accounts in the 'Finance' resource group. The solution must use role-based access control (RBAC). What should you assign?

Accepted Answer

Assign the Storage Blob Data Reader role to the Finance users at the Finance resource group scope. Assigning the Storage Blob Data Reader role at the Finance resource group scope grants Finance users read access to blob data within all storage accounts in that resource group, using RBAC. This meets the requirement of restricting access to only the Finance department while leveraging Azure RBAC's built-in data plane role for storage.

Answer

Assign the Contributor role to the Finance users at the management group scope

Answer

Assign the Reader role to the Finance users at the subscription scope

Answer

Assign the Storage Account Contributor role to the Finance users at each storage account scope

Question 9

Your company uses Microsoft Sentinel for security monitoring. You need to design a solution that automatically responds to incidents involving high-severity alerts. The response should include creating an incident in Microsoft Teams and sending an email to the security team. What should you use?

Accepted Answer

Microsoft Sentinel automation rules and playbooks. Microsoft Sentinel automation rules and playbooks (built on Azure Logic Apps) are specifically designed to orchestrate automated responses to security incidents. When a high-severity alert triggers an incident, an automation rule can invoke a playbook that creates a Microsoft Teams message and sends an email via connectors like Office 365 Outlook, meeting the exact requirements.

Answer

Azure Policy with remediation tasks

Answer

Azure Monitor alert rules with action groups

Answer

Microsoft Defender for Cloud security alerts

Question 10

You are reviewing a custom RBAC role in Azure. The exhibit shows the role definition. A user with this role reports they cannot read diagnostic settings for a storage account in the Production resource group. What is the most likely cause?

Accepted Answer

The role does not include 'Microsoft.Storage/storageAccounts/read'. The user cannot read diagnostic settings because the custom role lacks the 'Microsoft.Storage/storageAccounts/read' permission. This permission is required to read the storage account resource itself, which is a prerequisite for accessing its diagnostic settings. Without it, the role cannot perform any read operations on the storage account, including reading diagnostic logs or metrics configuration.

Answer

Custom roles cannot be assigned to users

Answer

The role lacks the 'Microsoft.Storage/storageAccounts/listKeys/action' permission

Answer

The role is assigned at the wrong scope

Question 11

Your organization plans to use Azure Policy to enforce tagging on all resources. The tags must include 'CostCenter' and 'Environment'. Resources that do not have these tags should be automatically remediated. What should you use?

Accepted Answer

A policy with 'deployIfNotExists' effect and a remediation task. The 'deployIfNotExists' effect is correct because it allows Azure Policy to evaluate resources for missing tags and then deploy a remediation task that automatically adds the required tags. This effect is specifically designed for scenarios where non-compliance can be corrected by deploying or modifying resources, such as adding tags via a policy definition that triggers a remediation task.

Answer

A policy with 'append' effect

Answer

A policy with 'audit' effect

Answer

A policy with 'deny' effect

Question 12

Your organization uses Microsoft Purview for data governance. You need to classify sensitive data in Azure SQL Database and automatically apply sensitivity labels. What should you configure?

Accepted Answer

Microsoft Purview Data Map with scanning and labeling. Microsoft Purview Data Map with scanning and labeling is the correct solution because it integrates with Azure SQL Database to automatically scan for sensitive data types (e.g., credit card numbers, social security numbers) and apply sensitivity labels defined in Microsoft Purview Information Protection. This native integration uses the Purview scanning infrastructure to classify data at rest and propagate labels directly to the SQL database, meeting the requirement for automated classification and labeling.

Answer

Azure Information Protection scanner

Answer

Microsoft Sentinel with a workbook

Answer

Azure Policy with built-in SQL classification policy

Question 13

Which TWO actions should you take to implement a least-privilege identity strategy for Azure resources?

Accepted Answer

Use managed identities for Azure resources instead of service principals with secrets. Managed identities for Azure resources eliminate the need to manage credentials by automatically rotating them and binding them to a resource lifecycle. This removes the risk of secret leakage or mismanagement that exists with service principal secrets, directly supporting a least-privilege identity strategy by ensuring identities are scoped and ephemeral.

Answer

Assign the Contributor role at the subscription scope to allow flexibility

Answer

Use storage account keys for access to blob data

Answer

Use a single service principal for all applications

Question 14

Which THREE components are required to monitor and audit Azure resource changes using Azure Monitor?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is required because it serves as the central repository where Azure Monitor collects and stores log data from various sources, including diagnostic settings and activity logs. Without a workspace, there is no destination for the logs to be ingested, queried, or analyzed, making it an essential component for monitoring and auditing resource changes.

Answer

An Application Insights resource

Answer

Azure Policy with audit effect

Question 15

Which TWO Microsoft Entra ID features should you use to protect against credential attacks?

Accepted Answer

Password Protection. Password Protection is correct because it specifically targets credential attacks by blocking weak passwords and common variations (e.g., 'Password123!') using a global banned password list and the option to add custom terms. Identity Protection is correct because it uses real-time risk detection (e.g., leaked credentials, anonymous IP addresses) to automatically block or require MFA for suspicious sign-ins, directly mitigating credential-based attacks like password spray or brute force.

Answer

Group-based licensing

Answer

Self-Service Password Reset (SSPR)

Answer

Application Proxy