AZ-305 Design identity, governance, and monitoring solutions Practice Test 15 — 15 Questions

Question 1

Your organization plans to deploy Microsoft Entra ID Governance. You need to ensure that access to critical applications is reviewed quarterly by the application owners. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra ID Access Reviews. Microsoft Entra ID Access Reviews (Option D) is the correct feature because it enables recurring, delegated review of user access to applications, groups, or roles. By configuring an access review with quarterly frequency and assigning application owners as reviewers, you directly meet the requirement for periodic attestation of access to critical applications. This is the specific Entra ID capability designed for governance-driven access recertification.

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Entitlement Management

Answer

Microsoft Entra ID Terms of Use

Question 2

You are designing a monitoring solution for an Azure function app that processes messages from Azure Service Bus. The function app is critical and must be highly available. You need to monitor for poison messages and trigger an alert when the dead-letter queue count exceeds 100. What should you use?

Accepted Answer

Azure Monitor metric alert on the dead-letter message count. Azure Monitor metric alerts can directly monitor the 'Dead-letter message count' metric for a Service Bus namespace or entity. When this count exceeds 100, the alert triggers, enabling automated response to poison messages without additional query overhead. This is the most efficient and native monitoring solution for real-time threshold-based alerts on Service Bus metrics.

Answer

Azure Service Bus Explorer

Answer

Azure Log Analytics workspace querying Service Bus logs

Answer

Azure Application Insights availability tests

Question 3

Which TWO actions should you take to implement a least-privilege identity strategy for Azure resources?

Accepted Answer

Use managed identities for Azure resources instead of service principals. Option D is correct because managed identities for Azure resources eliminate the need to store and manage credentials. Azure automatically rotates the identity's principal in Azure AD, and the resource can obtain an access token directly from the Azure Instance Metadata Service (IMDS) endpoint without any secrets. This aligns with the least-privilege principle by removing static, long-lived credentials and reducing the attack surface.

Answer

Assign Global Administrator role to all cloud architects

Answer

Store service principal passwords in Azure Key Vault and retrieve at runtime

Answer

Enable self-service password reset for all users

Question 4

Which THREE Azure Monitor capabilities can be used to detect and diagnose performance issues in a multi-tier application?

Accepted Answer

Live Metrics Stream in Application Insights. Live Metrics Stream in Application Insights (Option C) provides real-time monitoring of application performance metrics, such as request rates, response times, and failure rates, with sub-second latency. This allows immediate detection of performance issues as they occur, making it ideal for diagnosing live problems in a multi-tier application.

Answer

Azure Monitor Workbooks

Answer

Azure Policy

Question 5

Which TWO features of Microsoft Entra ID can be used to secure hybrid identities?

Accepted Answer

Seamless Single Sign-On. Seamless Single Sign-On (Seamless SSO) automatically signs users in when they are on corporate devices connected to the corporate network, eliminating password prompts. Password Hash Synchronization (PHS) synchronizes a hash of the user's on-premises AD password to Azure AD, enabling cloud authentication without additional infrastructure. Both features directly secure hybrid identities by extending on-premises credentials to the cloud.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Azure Active Directory Domain Services

Question 6

Refer to the exhibit. You are reviewing the output of an Azure Key Vault secret listing command. The application team reports that a secret is not accessible. What is the most likely reason?

Accepted Answer

The secret has expired. The secret listing output shows an 'expires' field with a date in the past, indicating the secret has expired. Azure Key Vault enforces expiration by preventing access to secrets whose expiration date has passed, returning a 403 Forbidden error. This is the most likely reason the application cannot access the secret.

Answer

The secret is tagged as production but the application is in development

Answer

The Key Vault is in a soft-deleted state

Answer

The secret is disabled

Question 7

Refer to the exhibit. You are reviewing an Azure Policy definition. Which virtual machines will be denied?

Accepted Answer

All virtual machines except those with SKU Standard_DS2_v2. The Azure Policy definition uses a 'deny' effect with a condition that checks if the virtual machine's SKU field is not equal to 'Standard_DS2_v2'. This means any VM whose SKU does not match 'Standard_DS2_v2' will be denied. Only VMs with the exact SKU 'Standard_DS2_v2' will be allowed, making option D correct.

Answer

No virtual machines because the condition is invalid

Answer

All virtual machines regardless of SKU

Answer

Only virtual machines with SKU Standard_DS2_v2

Question 8

Refer to the exhibit. You are reviewing a KQL query in Microsoft Sentinel. The query returns no results. Which is the most likely cause?

Accepted Answer

Microsoft Entra ID Protection is not enabled for the tenant. The KQL query references the 'IdentityLogonEvents' table, which is populated by Microsoft Entra ID Protection. If Entra ID Protection is not enabled, this table will contain no data, causing the query to return zero results even if the syntax, column names, and time range are correct.

Answer

The syntax is invalid because where clause should use == instead of ==

Answer

The column names are incorrect

Answer

The time range is too short

Question 9

You are designing a governance solution for a Microsoft Azure environment that contains multiple subscriptions. You need to ensure that all resources are compliant with corporate security policies. The solution must automatically remediate non-compliant resources. What should you include in the design?

Accepted Answer

Azure Policy with DeployIfNotExists effect. Azure Policy with the DeployIfNotExists effect is the correct choice because it automatically remediates non-compliant resources by triggering a deployment (e.g., via a template) when a resource is created or updated and does not meet the policy condition. This ensures continuous compliance with corporate security policies without manual intervention, as the effect can also be assigned a remediation task to fix existing resources.

Answer

Azure RBAC custom roles

Answer

Azure Resource Graph queries

Answer

Azure Blueprints

Question 10

Refer to the exhibit. You are implementing an Azure Policy to control VM SKU deployment. You assign this policy to a subscription. A developer attempts to deploy a virtual machine with SKU Standard_DS2_v2. What is the outcome?

Accepted Answer

The deployment is denied.. The Azure Policy in the exhibit uses a 'deny' effect, which explicitly blocks any deployment that does not match the allowed VM SKUs. Since Standard_DS2_v2 is not in the allowed list, the policy engine evaluates the request during deployment and rejects it before any resource is created. This results in the deployment being denied entirely, not just audited or flagged.

Answer

The deployment is audited and logged.

Answer

The deployment is allowed.

Answer

The VM is deployed but flagged as non-compliant.

Question 11

Your company requires that all administrative actions in Azure subscriptions be logged and retained for seven years. Which service should you use to collect and store these logs?

Accepted Answer

Azure Activity Log. The Azure Activity Log (now part of Azure Monitor) records all control-plane operations (create, update, delete) on Azure resources and can be retained for up to seven years by configuring a diagnostic setting to stream the logs to a Log Analytics workspace or Azure Storage. This meets the requirement for logging and long-term retention of administrative actions.

Answer

Azure Monitor Metrics

Answer

Azure Resource Health

Answer

Microsoft Entra ID audit logs

Question 12

You are designing a monitoring solution for a critical application running on Azure virtual machines. The application must maintain an SLA of 99.99% uptime. You need to be notified within five minutes if any VM becomes unavailable. What should you configure?

Accepted Answer

Azure Monitor VM Insights with availability metric alerts. Option D is correct because VM Insights with availability metric alerts monitors the heartbeat of Azure VMs and triggers an alert within five minutes if a VM becomes unavailable. This directly supports the 99.99% SLA requirement by enabling rapid notification of downtime, using the 'VM Availability Metric (Preview)' which tracks the VM's running state via the Azure Resource Health provider.

Answer

Log Analytics workspaces

Answer

Azure Advisor recommendations

Answer

Azure Service Health alerts

Question 13

You are designing an identity solution for a multinational company that uses Microsoft Entra ID. The company has a requirement that all users must authenticate using biometrics or FIDO2 security keys. Which Entra ID feature should you configure?

Accepted Answer

Conditional Access policies. Option D is correct because Conditional Access policies in Microsoft Entra ID allow you to enforce authentication strength requirements, such as requiring biometrics or FIDO2 security keys, by targeting specific user groups or applications. This is achieved by configuring a Conditional Access policy with the 'Require multifactor authentication' control and integrating with authentication methods like Windows Hello for Business or FIDO2 security keys, ensuring that only passwordless authentication methods meeting the company's biometric or FIDO2 requirement are permitted.

Answer

Passwordless authentication

Answer

Identity Protection

Answer

Entra Verified ID

Question 14

Which TWO actions can be performed using Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Manage access packages for internal and external users. Microsoft Entra ID Governance includes entitlement management, which allows administrators to create and manage access packages that bundle resources (like groups, apps, and SharePoint sites) and assign them to internal and external users. This enables automated lifecycle management of access, including expiration and renewal, making Option B correct.

Answer

Synchronize users from on-premises Active Directory

Answer

Configure network security group rules

Answer

Deploy virtual machines in Azure

Question 15

Which THREE components are required to implement a complete monitoring solution with Azure Monitor? (Choose three.)

Accepted Answer

Alert rules to notify on conditions. Alert rules (C) are a core component of a complete monitoring solution because they define conditions that trigger notifications or automated actions when monitored metrics or log data cross thresholds. Without alert rules, collected data remains passive and cannot proactively inform administrators of issues, making the solution incomplete.

Answer

Application Insights for every application

Answer

Azure Policy assignments