AZ-305 Design identity, governance, and monitoring solutions Practice Test 16 — 15 Questions

Question 1

You are designing a governance strategy for an Azure environment that includes multiple subscriptions. The security team requires that all storage accounts must have HTTPS traffic only. Any non-compliant storage account must be automatically remediated. What is the most efficient solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Policy with a DeployIfNotExists effect to enable HTTPS-only traffic. Azure Policy with a DeployIfNotExists effect can automatically remediate non-compliant storage accounts by enabling the 'HTTPS traffic only' property. This approach ensures continuous compliance without manual intervention, meeting the security team's requirement for automatic remediation.

Answer

Create an Azure Blueprint that includes a policy initiative

Answer

Assign a custom RBAC role that denies creation of storage accounts without HTTPS

Answer

Configure Azure Monitor alerts to notify the security team

Question 2

Your organization uses Microsoft Entra ID and Azure Key Vault. You need to ensure that a custom application can securely access secrets in Key Vault without storing credentials in code. The application runs on an Azure Virtual Machine. What should you use?

Accepted Answer

Assign a system-assigned managed identity to the VM. A system-assigned managed identity for Azure Virtual Machines allows the application to authenticate to Azure Key Vault without storing any credentials in code. Azure automatically manages the identity's lifecycle and tokens, enabling the VM to obtain an access token from Microsoft Entra ID (now Microsoft Entra ID) to call Key Vault's REST API. This aligns with the principle of zero-trust and eliminates the need for service principals or certificates in the application.

Answer

Store the Key Vault URL and connection string in the application configuration

Answer

Create a service principal and upload a certificate to the VM

Answer

Use a shared access signature (SAS) token

Question 3

Your organization plans to deploy Microsoft Entra ID Governance. You need to ensure that access to critical applications is reviewed quarterly by the application owners. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra ID Access Reviews. Microsoft Entra ID Access Reviews (Option D) is the correct feature because it enables recurring, delegated review of user access to applications, groups, or roles. By configuring an access review with quarterly frequency and assigning application owners as reviewers, you directly meet the requirement for periodic attestation of access to critical applications. This is the specific Entra ID capability designed for governance-driven access recertification.

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Entitlement Management

Answer

Microsoft Entra ID Terms of Use

Question 4

You are designing a monitoring solution for an Azure function app that processes messages from Azure Service Bus. The function app is critical and must be highly available. You need to monitor for poison messages and trigger an alert when the dead-letter queue count exceeds 100. What should you use?

Accepted Answer

Azure Monitor metric alert on the dead-letter message count. Azure Monitor metric alerts can directly monitor the 'Dead-letter message count' metric for a Service Bus namespace or entity. When this count exceeds 100, the alert triggers, enabling automated response to poison messages without additional query overhead. This is the most efficient and native monitoring solution for real-time threshold-based alerts on Service Bus metrics.

Answer

Azure Service Bus Explorer

Answer

Azure Log Analytics workspace querying Service Bus logs

Answer

Azure Application Insights availability tests

Question 5

Which THREE Azure Monitor capabilities can be used to detect and diagnose performance issues in a multi-tier application?

Accepted Answer

Live Metrics Stream in Application Insights. Live Metrics Stream in Application Insights (Option C) provides real-time monitoring of application performance metrics, such as request rates, response times, and failure rates, with sub-second latency. This allows immediate detection of performance issues as they occur, making it ideal for diagnosing live problems in a multi-tier application.

Answer

Azure Monitor Workbooks

Answer

Azure Policy

Question 6

Which TWO features of Microsoft Entra ID can be used to secure hybrid identities?

Accepted Answer

Seamless Single Sign-On. Seamless Single Sign-On (Seamless SSO) automatically signs users in when they are on corporate devices connected to the corporate network, eliminating password prompts. Password Hash Synchronization (PHS) synchronizes a hash of the user's on-premises AD password to Microsoft Entra ID, enabling cloud authentication without additional infrastructure. Both features directly secure hybrid identities by extending on-premises credentials to the cloud.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Azure Active Directory Domain Services

Question 7

Refer to the exhibit. You are reviewing an Azure Policy definition. Which virtual machines will be denied?

Accepted Answer

All virtual machines except those with SKU Standard_DS2_v2. The Azure Policy definition uses a 'deny' effect with a condition that checks if the virtual machine's SKU field is not equal to 'Standard_DS2_v2'. This means any VM whose SKU does not match 'Standard_DS2_v2' will be denied. Only VMs with the exact SKU 'Standard_DS2_v2' will be allowed, making option D correct.

Answer

No virtual machines because the condition is invalid

Answer

All virtual machines regardless of SKU

Answer

Only virtual machines with SKU Standard_DS2_v2

Question 8

You are designing a governance solution for a Microsoft Azure environment that contains multiple subscriptions. You need to ensure that all resources are compliant with corporate security policies. The solution must automatically remediate non-compliant resources. What should you include in the design?

Accepted Answer

Azure Policy with DeployIfNotExists effect. Azure Policy with the DeployIfNotExists effect is the correct choice because it automatically remediates non-compliant resources by triggering a deployment (e.g., via a template) when a resource is created or updated and does not meet the policy condition. This ensures continuous compliance with corporate security policies without manual intervention, as the effect can also be assigned a remediation task to fix existing resources.

Answer

Azure RBAC custom roles

Answer

Azure Resource Graph queries

Answer

Azure Blueprints

Question 9

Refer to the exhibit. You are implementing an Azure Policy to control VM SKU deployment. You assign this policy to a subscription. A developer attempts to deploy a virtual machine with SKU Standard_DS2_v2. What is the outcome?

Accepted Answer

The deployment is denied.. The Azure Policy in the exhibit uses a 'deny' effect, which explicitly blocks any deployment that does not match the allowed VM SKUs. Since Standard_DS2_v2 is not in the allowed list, the policy engine evaluates the request during deployment and rejects it before any resource is created. This results in the deployment being denied entirely, not just audited or flagged.

Answer

The deployment is audited and logged.

Answer

The deployment is allowed.

Answer

The VM is deployed but flagged as non-compliant.

Question 10

Your company requires that all administrative actions in Azure subscriptions be logged and retained for seven years. Which service should you use to collect and store these logs?

Accepted Answer

Azure Activity Log. The Azure Activity Log (now part of Azure Monitor) records all control-plane operations (create, update, delete) on Azure resources and can be retained for up to seven years by configuring a diagnostic setting to stream the logs to a Log Analytics workspace or Azure Storage. This meets the requirement for logging and long-term retention of administrative actions.

Answer

Azure Monitor Metrics

Answer

Azure Resource Health

Answer

Microsoft Entra ID audit logs

Question 11

You are designing an identity solution for a multinational company that uses Microsoft Entra ID. The company has a requirement that all users must authenticate using biometrics or FIDO2 security keys. Which Entra ID feature should you configure?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID allow you to enforce authentication strength requirements, such as requiring biometrics or FIDO2 security keys, by targeting specific user groups or applications. This is achieved by configuring a Conditional Access policy with the 'Require multifactor authentication' control and integrating with authentication methods like Windows Hello for Business or FIDO2 security keys, ensuring that only passwordless authentication methods meeting the company's biometric or FIDO2 requirement are permitted.

Answer

Passwordless authentication

Answer

Identity Protection

Answer

Entra Verified ID

Question 12

Which TWO actions can be performed using Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Manage access packages for internal and external users. Microsoft Entra ID Governance includes entitlement management, which allows administrators to create and manage access packages that bundle resources (like groups, apps, and SharePoint sites) and assign them to internal and external users. This enables automated lifecycle management of access, including expiration and renewal, making Option B correct.

Answer

Synchronize users from on-premises Active Directory

Answer

Configure network security group rules

Answer

Deploy virtual machines in Azure

Question 13

Which THREE components are required to implement a complete monitoring solution with Azure Monitor? (Choose three.)

Accepted Answer

Alert rules to notify on conditions. Alert rules (C) are a core component of a complete monitoring solution because they define conditions that trigger notifications or automated actions when monitored metrics or log data cross thresholds. Without alert rules, collected data remains passive and cannot proactively inform administrators of issues, making the solution incomplete.

Answer

Application Insights for every application

Answer

Azure Policy assignments

Question 14

Which TWO Microsoft Entra ID editions include Conditional Access? (Choose two.)

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1 includes Conditional Access, which allows organizations to enforce access policies based on signals like user, location, device, and application. This edition provides the core Conditional Access capabilities needed for most enterprise scenarios, such as requiring multi-factor authentication or blocking access from untrusted locations.

Answer

Azure AD Basic (legacy)

Answer

Microsoft 365 Business Basic

Answer

Microsoft Entra ID Free

Question 15

Which THREE Azure services can be used to monitor the performance of a web application? (Choose three.)

Accepted Answer

Application Insights. Application Insights (B) is correct because it is the APM feature of Azure Monitor that automatically collects request rates, response times, failure rates, dependency calls, and server/client performance telemetry for web applications. Azure Monitor Metrics (C) is correct because it stores numeric time-series performance data such as CPU percentage, memory usage, request counts, and response times that can be charted and alerted on. Azure Monitor Logs (E) is correct because Log Analytics workspaces collect and query detailed telemetry (e.g., via KQL over AppRequests, Perf, and AppTraces tables) to analyze web app performance and trends. Azure Policy (A) is incorrect because it enforces governance and compliance rules on resources rather than monitoring runtime performance. Microsoft Defender for Cloud (D) is incorrect because it provides security posture management and threat protection, not application performance monitoring.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud