AZ-305 Design identity, governance, and monitoring solutions Practice Test 15 — 15 Questions

Question 1

Your organization uses Azure Monitor to monitor a fleet of 500 VMs running Windows Server. You need to collect security event logs (Event ID 4625 for failed logons) from all VMs and send them to a Log Analytics workspace. The solution must support centralized configuration and be scalable. You also want to filter out high-volume noise events to reduce costs. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the Azure Monitor agent via Azure Policy and create a data collection rule to collect Event ID 4625.. The Azure Monitor agent (AMA) is the current recommended agent for collecting security events from VMs, and using Azure Policy to deploy it ensures centralized, scalable configuration across 500 VMs. A data collection rule (DCR) can be configured to collect only Event ID 4625, filtering out high-volume noise events at the source, which reduces costs by minimizing data ingestion into the Log Analytics workspace.

Answer

Enable VM Insights on all VMs and use the Performance view to detect failed logons.

Answer

Stream events to Azure Event Hubs and use a function to filter and send to Log Analytics.

Answer

Install the Log Analytics agent on each VM and configure Windows Event log collection in the workspace.

Question 2

Your company is implementing a new Azure subscription for a project that requires strict separation of duties. The security team requires that all resource creation must be approved by a central IT team. Additionally, any resource that does not comply with company tagging standards should be automatically reported. You need to design a solution that meets these requirements using Azure Policy and Azure Role-Based Access Control (RBAC). What should you do?

Accepted Answer

Create a custom RBAC role that allows only the IT team to add a specific 'Approved' tag. Use Azure Policy with 'Deny' effect to block resources without that tag. Use a separate 'Audit' policy for other tagging standards.. It uses a custom RBAC role to restrict the ability to add an 'Approved' tag to the IT team, combined with a Deny policy that blocks creation of any resource lacking that tag, ensuring all resource creation requires IT approval. The separate Audit policy automatically reports resources that fail to meet other company tagging standards, fulfilling both the approval and compliance reporting requirements without manual intervention.

Answer

Use Azure Policy with 'Audit' effect to report non-compliant resources. Use Azure RBAC to assign Owner role to IT team.

Answer

Use Azure Policy with 'Append' effect to automatically add required tags at creation. Use Azure Monitor alerts for non-compliance.

Answer

Create an Azure Policy with 'DeployIfNotExists' to deploy a tagging template. Use Azure RBAC to assign Contributor role to IT team.

Question 3

Your company plans to deploy a new application to Azure. The application will be used by external partners. You need to design an identity solution that allows partners to authenticate using their own corporate credentials while ensuring that the application can enforce conditional access policies based on partner device compliance. What should you include in the design?

Accepted Answer

Configure Microsoft Entra B2B collaboration and enable conditional access policies for guest users.. Microsoft Entra B2B collaboration allows you to invite external partners as guest users who can authenticate with their own corporate credentials. You can then enforce conditional access policies, including device compliance checks, on these guest users by targeting the policy to the 'Guest' user type or specific external users.

Answer

Federate your Microsoft Entra tenant with each partner's on-premises Active Directory.

Answer

Create guest user accounts in your Microsoft Entra tenant and assign them application roles.

Answer

Configure Microsoft Entra B2C and federate with partner identity providers.

Question 4

Refer to the exhibit. You are an Azure administrator for a company that enforces a policy that no virtual networks or network security groups can be created. However, a developer reports that they successfully created a virtual network. What is the most likely reason the policy did not block the creation?

Accepted Answer

The policy was assigned to a scope that does not include the subscription or resource group where the virtual network was created.. Azure Policy assignments are scoped to a specific management group, subscription, or resource group. If the policy was assigned to a scope that does not include the subscription or resource group where the developer created the virtual network, the policy would not apply, and the creation would succeed. The policy definition itself may be valid, but without proper assignment scope, it cannot enforce the deny effect.

Answer

The policy definition contains a syntax error.

Answer

The policy only applies to network security groups, not virtual networks.

Answer

The policy effect should be 'append' instead of 'deny'.

Question 5

Your company uses Microsoft Entra ID for identity management. You need to design a monitoring solution for sign-in logs to detect suspicious activity. Which TWO Azure services should you include in the design?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (Option B) is correct because it provides Cloud Access Security Broker (CASB) capabilities that analyze sign-in logs for anomalous behavior, such as impossible travel, suspicious IP addresses, and credential theft. It integrates with Microsoft Entra ID to detect and respond to risky sign-in events in real time, making it a core component for monitoring suspicious activity.

Answer

Azure Monitor

Answer

Microsoft Purview

Answer

Log Analytics workspace

Question 6

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to design a solution to monitor changes to privileged groups in both directories and ensure that any unauthorized changes trigger an automated response. Which THREE services should you include in the design?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is correct because it serves as the centralized SIEM solution that can ingest logs from both Microsoft Entra ID (via diagnostic settings) and on-premises Active Directory (via Windows Security Events or Azure Monitor Agent). It enables analytics rules to detect unauthorized changes to privileged groups and trigger automated responses through playbooks or incident creation. Microsoft Defender for Identity is correct as it monitors on-premises Active Directory for malicious activities, including changes to privileged groups, and can trigger automated responses such as disabling accounts. Microsoft Entra Identity Protection is correct because it uses signals from the directory to identify suspicious activities related to privileged identities and can trigger automated responses like requiring multi-factor authentication or blocking access. Together, these three services provide comprehensive monitoring and automated response for privileged group changes in a hybrid identity environment.

Answer

Microsoft Purview

Answer

Group Policy Management Console

Question 7

You are designing a governance strategy for Azure resources. You need to enforce compliance with corporate standards and ensure that resource provisioning is audited. Which TWO Azure features should you include?

Accepted Answer

Azure Policy. Azure Policy is correct because it enforces compliance by applying rules (e.g., allowed SKUs, tagging requirements) to resources during provisioning and existing resources via audit or deny effects. It ensures corporate standards are met and provides continuous compliance evaluation, which directly addresses the need to enforce standards and audit provisioning.

Answer

Azure Role-Based Access Control

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 8

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to design a monitoring solution to detect when users are assigned to high-privilege roles (e.g., Global Administrator) and ensure that any such assignment triggers an automated investigation. Additionally, you need to monitor sign-in failures for guest users and automatically block accounts after 5 failed attempts within 10 minutes. You have the following requirements: 1) Use a cloud-native solution that minimizes administrative overhead. 2) Integrate with Microsoft Sentinel for incident response. 3) Use built-in features where possible. What should you do?

Accepted Answer

Use Microsoft Entra Privileged Identity Management (PIM) alerts for role assignments and Microsoft Entra Identity Protection for sign-in risk policies; integrate both with Microsoft Sentinel.. Microsoft Entra Privileged Identity Management (PIM) provides built-in alerts for high-privilege role assignments, and Microsoft Entra Identity Protection offers risk-based policies for sign-in failures, including user risk policies that can automatically block accounts after a specified number of failures. Both services natively integrate with Microsoft Sentinel via built-in data connectors, enabling automated incident creation with minimal administrative overhead, meeting all requirements.

Answer

Use Microsoft Entra audit logs streamed to Log Analytics, create Azure Logic Apps to detect role assignments and sign-in failures, and trigger Sentinel incidents.

Answer

Use Azure Policy to audit role assignments and create custom KQL functions in Log Analytics to detect sign-in failures, then forward to Sentinel.

Answer

Deploy Microsoft Identity Manager (MIM) on-premises to monitor role changes, and use Azure AD Connect Health for sign-in failures.

Question 9

Your organization has a complex Azure environment with multiple subscriptions. You need to design a governance strategy that ensures: 1) All resources must have specific tags (CostCenter, Environment, Owner). 2) Any resource without required tags must be reported to the compliance team weekly. 3) Virtual machines must not be deployed in certain regions due to data sovereignty. 4) The solution must be automated and use native Azure services. You already have an Azure Log Analytics workspace and a central automation account. What should you include in the design?

Accepted Answer

Use Azure Policy with 'audit' effect for missing tags and region restriction; use Azure Logic Apps triggered by a schedule to query Azure Resource Graph and email the compliance report.. It uses Azure Policy with 'audit' effect to detect missing tags and region violations without blocking deployment, which satisfies the reporting requirement. Azure Logic Apps, triggered on a schedule, queries Azure Resource Graph to identify non-compliant resources and sends an email report to the compliance team weekly, fulfilling the automation and native service criteria without manual intervention.

Answer

Use Azure Resource Graph queries to find untagged resources and export to CSV manually each week.

Answer

Use Azure Blueprints to define tags and region restrictions; use Azure Monitor alerts to report non-compliance.

Answer

Use Azure Policy with 'deny' effect for missing tags and an Azure Automation runbook to add tags weekly.

Question 10

You are designing identity governance for a company that uses Microsoft Entra ID. The company wants to grant external partners access to an internal application for 90 days. After 90 days, access must be automatically removed. Additionally, the application requires that users have multi-factor authentication (MFA) and a compliant device. You need to design a solution that meets these requirements with minimal administrative effort. What should you do?

Accepted Answer

Create an access package in Microsoft Entra entitlement management with a 90-day policy and conditional access policies for MFA and device compliance.. Microsoft Entra entitlement management allows you to create an access package that automatically grants external partners access to the application for exactly 90 days, after which access is automatically removed via an expiration policy. Additionally, you can enforce multi-factor authentication (MFA) and device compliance by configuring conditional access policies that are applied to the access package, meeting all requirements with minimal administrative effort through automation.

Answer

Manually create guest user accounts, assign app, and set calendar reminder to delete after 90 days.

Answer

Create a dynamic group in Microsoft Entra ID that includes partners and assign the app; use a scheduled script to remove membership after 90 days.

Answer

Use Microsoft Entra Privileged Identity Management to grant just-in-time access for 90 days.

Question 11

Your company operates in a highly regulated industry and must retain all sign-in logs for 7 years. The logs must be immutable and cannot be modified or deleted by administrators. You need to design a monitoring solution that stores sign-in logs in a cost-effective manner while meeting compliance requirements. The solution should also allow for real-time analysis of sign-in activity. What should you include in the design?

Accepted Answer

Stream sign-in logs to Log Analytics for real-time analysis and simultaneously archive them to an Azure Storage account with immutable blob policy (WORM).. It meets both compliance and real-time analysis requirements. Streaming sign-in logs to Log Analytics enables real-time monitoring and querying, while simultaneously archiving them to an Azure Storage account with an immutable blob policy (WORM) ensures the logs cannot be modified or deleted for the required 7-year retention period. This combination provides cost-effective long-term storage (Azure Blob is cheaper than Log Analytics for long-term retention) and satisfies regulatory immutability mandates.

Answer

Stream sign-in logs to Azure Event Hubs and then to cold storage in Azure Blob with lifecycle management.

Answer

Stream sign-in logs to Log Analytics workspace with 7-year retention and use Azure Policy to restrict deletion.

Answer

Use Azure Data Explorer to store logs for 7 years and configure a purge policy to prevent deletion.

Question 12

Your company plans to deploy a new SaaS application that will be used by employees and external users. The application requires single sign-on (SSO) and must support conditional access policies that enforce MFA for external users. Additionally, the application must be able to read user profile attributes from Microsoft Entra ID. You need to design an identity solution that meets these requirements. What should you include in the design?

Accepted Answer

Register the application in Microsoft Entra ID (App Registration) and configure it to use OpenID Connect for authentication; apply conditional access policies to the app.. Registering the application in Microsoft Entra ID (App Registration) and configuring OpenID Connect (OIDC) enables SSO and allows the application to read user profile attributes via the Microsoft Graph API. Conditional access policies can be applied directly to the enterprise app in Entra ID to enforce MFA for external users, meeting all stated requirements.

Answer

Use Azure AD Application Proxy to publish the SaaS app and configure pre-authentication with Entra ID.

Answer

Use Microsoft Entra Domain Services to authenticate the application via LDAP.

Answer

Register the application in Microsoft Entra B2C and configure federation with your Entra ID tenant.

Question 13

Your company has a large Azure environment with thousands of resources. You need to design a solution to track resource ownership and ensure that resources are cleaned up when projects end. You want to use a tag-based approach where each resource has an 'Owner' and 'Project' tag. Additionally, you need to generate a weekly report of resources that are not tagged or have been orphaned (no recent activity). What should you include in the design?

Accepted Answer

Use Azure Resource Graph queries in an Azure Logic App scheduled to run weekly, and send the report via email.. Azure Resource Graph (ARG) provides fast, queryable access to resource properties across subscriptions, enabling efficient identification of untagged or orphaned resources. Scheduling an Azure Logic App to run ARG queries weekly and email the report meets the requirements for automation and delivery without additional infrastructure. This approach is cost-effective and scales well for thousands of resources.

Answer

Use Azure Policy to audit missing tags and create a custom dashboard in Azure Monitor.

Answer

Use Azure Monitor alerts with a metric alert for unmodified resources.

Answer

Use Azure Automation runbook to inventory resources and store in a SQL database, then use Power BI to report.

Question 14

Your company uses Microsoft Sentinel for security monitoring. You need to design a solution to detect when a user account is created in Microsoft Entra ID with Global Administrator privileges. When detected, an incident must be created in Sentinel and the account should be disabled temporarily until reviewed. You want to use built-in capabilities where possible. What should you do?

Accepted Answer

Use a Microsoft Sentinel analytics rule template for 'Suspicious Entra ID role assignment' and configure a playbook to disable the account via Microsoft Graph API.. It uses a built-in Sentinel analytics rule template specifically designed to detect suspicious Entra ID role assignments, which meets the requirement for built-in capabilities. The playbook, triggered by the rule, can use the Microsoft Graph API to disable the account temporarily, providing automated remediation without custom code or external services.

Answer

Use Microsoft Entra Privileged Identity Management to require approval for role activation, and audit logs to detect permanent assignments.

Answer

Use Microsoft Defender for Cloud Apps to monitor for privileged role assignments and send an alert to Sentinel.

Answer

Create a custom KQL query in Log Analytics and schedule it as a Sentinel analytics rule, then use an Azure Function to disable the account.

Question 15

Your company has a hybrid identity environment with 10,000 on-premises users synchronized to Microsoft Entra ID using Microsoft Entra Connect. You plan to implement a modern access control strategy for all cloud applications. The requirements are: enforce multifactor authentication (MFA) for all users when accessing sensitive applications, allow users to self-remediate risky sign-ins via a mobile app, and minimize infrastructure complexity. You need to design the identity and governance solution. What should you do?

Accepted Answer

Configure Microsoft Entra ID Protection to detect risky sign-ins and create a conditional access policy that requires MFA for sensitive apps. Enable the risky user policy to require password change, and use Microsoft Authenticator for self-remediation.. It uses Microsoft Entra ID Protection to detect risky sign-ins and a Conditional Access policy to require MFA for sensitive applications, meeting the MFA enforcement requirement. The risky user policy requiring a password change combined with Microsoft Authenticator for self-remediation allows users to resolve their own risk without admin intervention, satisfying the self-remediation requirement. This approach minimizes infrastructure complexity by relying entirely on cloud-native services rather than on-premises components.

Answer

Deploy Azure AD Domain Services and configure Kerberos authentication for cloud apps. Use Azure MFA Server on-premises for MFA enforcement.

Answer

Implement Microsoft Defender for Identity to monitor on-premises AD and require MFA via on-premises NPS extension.

Answer

Use Microsoft Entra Permissions Management to enforce MFA policies and manage user permissions.