AZ-305 Design identity, governance, and monitoring solutions Practice Test 16 — 15 Questions

Question 1

Your organization has 500 users in Microsoft Entra ID. You need to ensure that users can only access Microsoft 365 apps from compliant devices (compliant with Intune policies). Users are already enrolled in Intune. The compliance policies are defined. You need to configure the access control mechanism. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy that requires device to be marked as compliant.. Conditional Access in Microsoft Entra ID is the mechanism that enforces access controls based on signals like device compliance. By creating a policy that requires the device to be marked as compliant, you ensure that only devices meeting Intune compliance policies can access Microsoft 365 apps. This directly addresses the requirement without blocking all access or relying on automatic revocation.

Answer

Create a Conditional Access policy that blocks all access and then create exclusions for compliant devices.

Answer

Configure Intune compliance policies to automatically revoke access for non-compliant devices.

Answer

Create a Conditional Access policy that requires MFA based on location.

Question 2

Your organization is deploying a critical application in Azure that must maintain an uptime SLA of 99.99%. The application runs on Azure Virtual Machines in a single region. You need to design a monitoring solution that alerts the operations team within 5 minutes of any VM unavailability. The solution must minimize false positives and avoid alert fatigue. What should you include in the design?

Accepted Answer

Configure Azure Monitor VM insights with availability metric alerts set to fire when the VM is unavailable for 2 out of the last 5 minutes.. VM insights availability metric alerts use the 'VM Availability' metric (a composite metric from the Azure Monitor agent) that tracks the VM's running state. Configuring it to fire when the VM is unavailable for 2 out of the last 5 minutes provides a 2-minute evaluation window, which balances the 5-minute notification requirement with a tolerance for transient blips, minimizing false positives. This approach directly monitors the VM's availability at the hypervisor level without relying on guest OS signals, ensuring reliable uptime detection for the 99.99% SLA.

Answer

Create an Azure Service Health alert for the 'Virtual machine' service.

Answer

Create an Azure Monitor alert based on the Activity Log for 'Virtual Machine Guest OS Unresponsive' events.

Answer

Deploy the Log Analytics agent on each VM and create an alert for when heartbeat data is missing for 5 minutes.

Question 3

You are designing a monitoring solution for a cloud-native application that uses Azure Functions, Azure Storage, and Azure Cosmos DB. The solution must provide centralized log collection and analysis, enable proactive alerting on application errors, and support long-term log retention for compliance (7 years). What should you include in the design?

Accepted Answer

Configure diagnostic settings for each Azure resource to send logs and metrics to a Log Analytics workspace.. It leverages Log Analytics workspace as a centralized destination for diagnostic settings from Azure Functions, Storage, and Cosmos DB, enabling unified log collection, Kusto Query Language (KQL)-based analysis, proactive alerting, and long-term retention (up to 7 years) for compliance. This design satisfies all requirements: centralized logging, alerting on application errors, and archival-grade retention.

Answer

Use Azure Storage with cool tier for logs and enable Azure Storage Analytics logs.

Answer

Store logs in Azure Monitor Metrics with a retention of 93 days.

Answer

Use Application Insights to collect logs and set retention to 90 days, then export to Azure Blob Storage for archival.

Question 4

You are designing an identity solution for a multinational company that has a Microsoft Entra ID tenant. The company plans to acquire a smaller company that currently uses an on-premises Active Directory (AD) forest. The acquired company's users need to access Microsoft 365 applications and Azure resources. The solution must minimize identity management overhead. Which TWO actions should you include in the design? (Choose two.)

Accepted Answer

Configure Microsoft Entra Connect Sync to synchronize users from the on-premises AD to the new Entra ID tenant.. Microsoft Entra Connect Sync synchronizes on-premises AD users to the existing Microsoft Entra ID tenant, enabling single sign-on and unified identity management without creating a separate tenant. This minimizes overhead by avoiding duplicate identity stores and manual provisioning for the acquired company's users.

Answer

Federate the on-premises AD with the existing Microsoft Entra ID tenant.

Answer

Establish a cross-tenant trust between the existing and new Entra ID tenants.

Answer

Use Microsoft Entra B2B collaboration to invite users from the acquired company.

Question 5

You are reviewing a JSON policy for Microsoft Entra Privileged Identity Management (PIM) that governs activation of a privileged role for an Azure App Service. You notice that the policy has the configuration shown in the exhibit. You need to ensure that only members of the 'group-app-admins@contoso.com' group can activate the role and that activations are limited to 8 hours with approval required. However, users report that they cannot activate the role even though they are members of the group. What is the most likely cause?

Accepted Answer

The PIM role has not been scoped to the 'myapp' App Service resource.. The PIM role must be explicitly scoped to the specific Azure resource (in this case, the 'myapp' App Service) for activation to be possible. Without this scope, the role assignment does not apply to the resource, and even authorized group members cannot activate it. The policy configuration shown likely defines eligibility and approval rules but omits the resource scope, which is a required step in PIM for Azure resources.

Answer

The group 'group-app-admins@contoso.com' has an expiration policy that has expired.

Answer

The group 'group-app-admins@contoso.com' is a mail-enabled security group, which is not supported for PIM.

Answer

The approval required setting is incorrectly configured and requires a global administrator as approver.

Question 6

A company uses Microsoft Entra ID for identity management. They need to automate the process of granting access to resources for employees and external partners, and require periodic access reviews to ensure compliance. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management. Microsoft Entra ID Entitlement Management is the correct feature because it enables automation of access request workflows for employees and external partners, including time-limited access packages and periodic access reviews to enforce compliance. This directly matches the requirement for granting access and ensuring ongoing governance through reviews.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Question 7

A company wants to collect metrics and logs from all Azure resources in their subscription, including custom metrics from their applications, and create dashboards and alerts. Which Azure service should they use as the primary monitoring platform?

Accepted Answer

Azure Monitor. Azure Monitor is the correct primary monitoring platform because it serves as the single, unified ingestion and analysis service for all metrics and logs across Azure resources, including custom metrics from applications via the Application Insights SDK or the custom metrics API. It provides a consolidated workspace for creating dashboards, setting alerts, and querying data, making it the foundational service for observability in Azure.

Answer

Azure Log Analytics

Answer

Azure Application Insights

Answer

Azure Service Health

Question 8

A company uses Microsoft Entra ID B2B to collaborate with external vendors. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from compliant devices (e.g., managed by Intune). They also want to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

Accepted Answer

B. It combines Conditional Access policies with session controls to enforce MFA, device compliance (via Intune), and a 1-hour session timeout. Conditional Access policies evaluate sign-in risk and require MFA and compliant devices, while the session control 'Sign-in frequency' can be set to 1 hour to enforce reauthentication. This meets all three requirements without relying on deprecated or separate features.

Answer

A

Answer

C

Answer

D

Question 9

A company uses Microsoft Entra ID and wants to allow users to sign in using their existing personal Microsoft accounts, Google, and Facebook identities. They also need custom sign-up and sign-in flows with collection of specific user attributes. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID B2C. Microsoft Entra ID B2C (Business-to-Consumer) is the correct choice because it is specifically designed to support external identity providers like personal Microsoft accounts, Google, and Facebook, and it provides a customizable policy framework (user flows) for sign-up and sign-in that can collect custom user attributes. Unlike B2B, which focuses on business partner collaboration, B2C allows you to define attribute collection during registration via built-in or custom policies.

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Conditional Access

Question 10

A company uses Microsoft Entra ID and wants to enforce that all users must use multi-factor authentication (MFA) when accessing sensitive applications. However, they want to exclude users when connecting from the corporate office IP range and only allow access from devices that are compliant with Intune policies. Which Microsoft Entra ID feature should they use to create this policy?

Accepted Answer

Microsoft Entra ID Conditional Access. C is correct because Microsoft Entra ID Conditional Access is the feature specifically designed to enforce granular access policies based on conditions such as user, location, device compliance, and application sensitivity. By configuring a Conditional Access policy, you can require MFA for sensitive applications, exclude the corporate office IP range, and restrict access to Intune-compliant devices, all within a single policy.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Identity Governance

Question 11

A multinational company uses Microsoft Entra ID. The company has regional IT teams that need to manage users and groups within their respective regions. Each region has a distinct set of users in specific organizational units. The company wants to assign the User Administrator role to regional IT staff, but limit their scope to only the users in their region. Which Microsoft Entra ID feature should they use?

Accepted Answer

Administrative Units. Administrative Units in Microsoft Entra ID allow you to delegate administrative roles, such as User Administrator, to a specific subset of users and groups defined by organizational boundaries (e.g., region). By creating an Administrative Unit for each region and adding the regional users and groups to it, you can assign the User Administrator role scoped to that unit, ensuring regional IT staff can only manage their own region's identities.

Answer

Dynamic Groups

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Identity Protection

Question 12

A company uses Microsoft Entra ID B2B collaboration for external partners. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from devices that are compliant with Intune policies. Additionally, they need to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

Accepted Answer

Configure cross-tenant access settings to trust MFA and device compliance from external organizations, and then create a Conditional Access policy that requires MFA, compliant device, and a session sign-in frequency of 1 hour.. Cross-tenant access settings in Microsoft Entra ID allow you to trust MFA and device compliance claims from external organizations, which is necessary when external users bring their own devices. Then, a Conditional Access policy targeting external users can enforce MFA, require compliant device, and set a session sign-in frequency of 1 hour using session controls. This combination ensures that the company's security requirements are met without relying on the external tenant's policies.

Answer

Create a Conditional Access policy for external users that requires MFA and compliant device, and set session controls for sign-in frequency. Trusting MFA from external tenants is automatic.

Answer

Use Microsoft Entra ID Identity Protection to detect risky sessions for external users and require MFA only when risk is high. This will also enforce device compliance automatically.

Answer

Configure Microsoft Entra ID Privileged Identity Management (PIM) for external users to activate MFA and require compliant device. PIM is for role activation, not for external user access policies.

Question 13

A company wants to allow remote users to access an internal web application hosted on-premises without opening inbound firewall ports. They need seamless single sign-on (SSO) using Microsoft Entra ID credentials. Which Azure service should they use?

Accepted Answer

Microsoft Entra ID Application Proxy. Microsoft Entra ID Application Proxy provides secure remote access to on-premises web applications without requiring inbound firewall ports. It works by establishing an outbound connection from the on-premises Application Proxy connector to the Entra ID service, then routing user traffic through that tunnel. It integrates with Entra ID for pre-authentication and supports seamless SSO using the user's existing Entra ID credentials via Kerberos constrained delegation (KCD) or header-based authentication.

Answer

Microsoft Entra ID B2C

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Connect

Question 14

A company wants to monitor sign-in activity for their Microsoft Entra ID-integrated applications. They need to detect risky sign-ins, such as sign-ins from anonymous IP addresses or unfamiliar locations, and automatically block or require multi-factor authentication. They also need a dashboard showing risk events and the ability to investigate and remediate. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it specifically detects and responds to risky sign-ins, such as those from anonymous IP addresses or unfamiliar locations, by automatically blocking access or requiring multi-factor authentication. It provides a dashboard of risk events (e.g., leaked credentials, impossible travel) and supports investigation and remediation workflows, directly matching the requirements for monitoring sign-in activity and enforcing conditional access policies.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Self-Service Password Reset (SSPR)

Question 15

A company uses Microsoft Entra ID. They want to grant a user temporary access to the Global Administrator role for a specific task. The access must require approval from a manager and automatically expire after 4 hours. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access, allowing users to activate roles like Global Administrator for a limited time. It supports approval workflows (manager approval) and configurable activation duration (e.g., 4 hours), making it the correct choice for temporary, approved, time-bound role elevation.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Access Reviews