AZ-305 Design identity, governance, and monitoring solutions Practice Test 17 — 15 Questions

Question 1

You are investigating a security incident where an unauthorized user may have modified a production VM. You run the KQL query shown in the exhibit in Microsoft Sentinel, but it returns no results. The VMs are present and have been modified recently. What is the most likely reason for no results?

Accepted Answer

The ResourceId contains the VM name in lowercase, but the extract pattern is case-sensitive.. Option D is correct because the KQL query uses the `extract` function with a pattern that expects the VM name in the ResourceId to be in lowercase, but the actual ResourceId contains the VM name in uppercase. The `extract` function in KQL is case-sensitive by default, so the pattern fails to match, returning no results. Even though the VMs have been modified, the query cannot parse the ResourceId correctly, leading to zero output.

Answer

The query does not filter by a time range, so it may be returning old data.

Answer

The Caller field is not included in the output, so the query cannot identify unauthorized users.

Answer

The OperationNameValue is incorrect; the correct value is 'MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE' in uppercase.

Question 2

Your company uses Azure Policy to enforce compliance. You need to ensure that all storage accounts use HTTPS only. The policy should automatically remediate non-compliant storage accounts by enabling HTTPS-only. What policy effect should you use?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it not only evaluates whether storage accounts have the 'HTTPS only' setting enabled but also automatically deploys a remediation task to enable it when non-compliance is detected. This ensures continuous compliance without manual intervention, which aligns with the requirement for automatic remediation.

Answer

Deny

Answer

AuditIfNotExists

Answer

Append

Question 3

Your company is planning to use Azure Monitor Workbooks to create custom dashboards for IT operations. You need to select the data sources that can be used in a workbook. Which TWO data sources are supported? (Choose two.)

Accepted Answer

Azure Resource Graph. Azure Monitor Workbooks support multiple data sources including Azure Resource Graph, Log Analytics workspaces, Azure Monitor Metrics, and more. Azure Resource Graph allows querying Azure resources across subscriptions. Log Analytics workspaces allow querying log data. Azure SQL Database is not directly a data source; you need a Log Analytics workspace that collects SQL logs. Azure Blob Storage is not a direct data source; you would need to use a Log Analytics workspace that ingests storage logs. Application Insights is supported as a data source.

Answer

Azure SQL Database

Answer

Microsoft Sentinel

Answer

Azure Blob Storage

Question 4

Your organization has multiple Azure subscriptions and uses Azure Blueprints to enforce governance. You need to design a blueprint that includes role assignments, policy assignments, and resource groups. Which THREE components can be included in an Azure Blueprint? (Choose three.)

Accepted Answer

Role assignments. Azure Blueprints allow you to define a repeatable set of Azure resources that adhere to your organization's standards, patterns, and requirements. Role assignments (B) are a core artifact that can be included to grant specific Azure RBAC roles at the blueprint scope, ensuring consistent access control. Policy assignments (C) are also a native blueprint artifact, enabling you to enforce compliance rules across the environment. ARM templates (E) can be included as an artifact to deploy infrastructure as code, making them a valid component of a blueprint definition.

Answer

Management group

Answer

Subscription

Question 5

Your company uses Microsoft Entra ID. You need to implement a governance strategy for guest users. Which TWO actions should you take? (Choose two.)

Accepted Answer

Create access reviews for guest users. Access reviews for guest users (Option A) are a core governance control in Microsoft Entra ID, allowing administrators to periodically review and confirm or revoke guest access. This ensures that guest accounts remain necessary and compliant with security policies, directly addressing the governance requirement.

Answer

Disable external identities

Answer

Block all guest user access

Answer

Enable self-service sign-up for guest users

Question 6

You are a cloud architect for a multinational corporation. The company has a single Azure tenant with a management group hierarchy: Root MG -> Corp MG -> (Finance, HR, IT, Marketing) child management groups. Each child management group contains multiple subscriptions. The IT governance team wants to enforce a policy that all Azure resources must have a 'CostCenter' tag. However, the Finance department has legacy resources that cannot be modified and must be exempt from this policy. You need to design a solution that meets the following requirements: (1) The policy should be applied to all subscriptions in the Corp MG except those in the Finance MG. (2) The policy should audit non-compliant resources but not deny them. (3) The solution must use Azure Policy and minimize administrative overhead. What should you do?

Accepted Answer

Assign the policy at the Corp management group scope and exclude the Finance management group.. Assigning the policy at the Corp management group scope and excluding the Finance management group meets all requirements: it applies the policy to all subscriptions under Corp (including Finance, HR, IT, Marketing) while the exclusion removes Finance from policy evaluation. Using the 'audit' effect ensures non-compliant resources are flagged but not denied, and this single assignment minimizes administrative overhead.

Answer

Assign the policy at the Root management group and exclude all child management groups except Corp.

Answer

Assign the policy at each child management group except Finance.

Answer

Assign the policy to each subscription individually, excluding those in Finance.

Question 7

Your organization uses Azure Monitor to monitor a fleet of 500 VMs running Windows Server. You need to collect security event logs (Event ID 4625 for failed logons) from all VMs and send them to a Log Analytics workspace. The solution must support centralized configuration and be scalable. You also want to filter out high-volume noise events to reduce costs. What should you do?

Accepted Answer

Deploy the Azure Monitor agent via Azure Policy and create a data collection rule to collect Event ID 4625.. Option D is correct because the Azure Monitor agent (AMA) is the current recommended agent for collecting security events from VMs, and using Azure Policy to deploy it ensures centralized, scalable configuration across 500 VMs. A data collection rule (DCR) can be configured to collect only Event ID 4625, filtering out high-volume noise events at the source, which reduces costs by minimizing data ingestion into the Log Analytics workspace.

Answer

Enable VM Insights on all VMs and use the Performance view to detect failed logons.

Answer

Stream events to Azure Event Hubs and use a function to filter and send to Log Analytics.

Answer

Install the Log Analytics agent on each VM and configure Windows Event log collection in the workspace.

Question 8

Your company is implementing a new Azure subscription for a project that requires strict separation of duties. The security team requires that all resource creation must be approved by a central IT team. Additionally, any resource that does not comply with company tagging standards should be automatically reported. You need to design a solution that meets these requirements using Azure Policy and Azure Role-Based Access Control (RBAC). What should you do?

Accepted Answer

Create a custom RBAC role that allows only the IT team to add a specific 'Approved' tag. Use Azure Policy with 'Deny' effect to block resources without that tag. Use a separate 'Audit' policy for other tagging standards.. Option D is correct because it uses a custom RBAC role to restrict the ability to add an 'Approved' tag to the IT team, combined with a Deny policy that blocks creation of any resource lacking that tag, ensuring all resource creation requires IT approval. The separate Audit policy automatically reports resources that fail to meet other company tagging standards, fulfilling both the approval and compliance reporting requirements without manual intervention.

Answer

Use Azure Policy with 'Audit' effect to report non-compliant resources. Use Azure RBAC to assign Owner role to IT team.

Answer

Use Azure Policy with 'Append' effect to automatically add required tags at creation. Use Azure Monitor alerts for non-compliance.

Answer

Create an Azure Policy with 'DeployIfNotExists' to deploy a tagging template. Use Azure RBAC to assign Contributor role to IT team.

Question 9

Your company plans to deploy a new application to Azure. The application will be used by external partners. You need to design an identity solution that allows partners to authenticate using their own corporate credentials while ensuring that the application can enforce conditional access policies based on partner device compliance. What should you include in the design?

Accepted Answer

Configure Microsoft Entra B2B collaboration and enable conditional access policies for guest users.. Option D is correct because Microsoft Entra B2B collaboration allows you to invite external partners as guest users who can authenticate with their own corporate credentials. You can then enforce conditional access policies, including device compliance checks, on these guest users by targeting the policy to the 'Guest' user type or specific external users.

Answer

Federate your Microsoft Entra tenant with each partner's on-premises Active Directory.

Answer

Create guest user accounts in your Microsoft Entra tenant and assign them application roles.

Answer

Configure Microsoft Entra B2C and federate with partner identity providers.

Question 10

Refer to the exhibit. You are an Azure administrator for a company that enforces a policy that no virtual networks or network security groups can be created. However, a developer reports that they successfully created a virtual network. What is the most likely reason the policy did not block the creation?

Accepted Answer

The policy was assigned to a scope that does not include the subscription or resource group where the virtual network was created.. Option C is correct because Azure Policy assignments are scoped to a specific management group, subscription, or resource group. If the policy was assigned to a scope that does not include the subscription or resource group where the developer created the virtual network, the policy would not apply, and the creation would succeed. The policy definition itself may be valid, but without proper assignment scope, it cannot enforce the deny effect.

Answer

The policy definition contains a syntax error.

Answer

The policy only applies to network security groups, not virtual networks.

Answer

The policy effect should be 'append' instead of 'deny'.

Question 11

Your company uses Microsoft Entra ID for identity management. You need to design a monitoring solution for sign-in logs to detect suspicious activity. Which TWO Azure services should you include in the design?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (Option B) is correct because it provides Cloud Access Security Broker (CASB) capabilities that analyze sign-in logs for anomalous behavior, such as impossible travel, suspicious IP addresses, and credential theft. It integrates with Microsoft Entra ID to detect and respond to risky sign-in events in real time, making it a core component for monitoring suspicious activity.

Answer

Azure Monitor

Answer

Microsoft Purview

Answer

Log Analytics workspace

Question 12

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to design a solution to monitor changes to privileged groups in both directories and ensure that any unauthorized changes trigger an automated response. Which THREE services should you include in the design?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is correct because it serves as the centralized SIEM (Security Information and Event Management) solution that can ingest logs from both Microsoft Entra ID (via diagnostic settings) and on-premises Active Directory (via Windows Security Events or Azure Monitor Agent). It allows you to create analytics rules that detect unauthorized changes to privileged groups and trigger automated responses, such as playbooks (Logic Apps) or incident creation, ensuring a unified monitoring and response workflow.

Answer

Microsoft Purview

Answer

Microsoft Entra Identity Protection

Answer

Group Policy Management Console

Question 13

You are designing a governance strategy for Azure resources. You need to enforce compliance with corporate standards and ensure that resource provisioning is audited. Which TWO Azure features should you include?

Accepted Answer

Azure Policy. Azure Policy is correct because it enforces compliance by applying rules (e.g., allowed SKUs, tagging requirements) to resources during provisioning and existing resources via audit or deny effects. It ensures corporate standards are met and provides continuous compliance evaluation, which directly addresses the need to enforce standards and audit provisioning.

Answer

Azure Role-Based Access Control

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 14

You are designing an identity lifecycle management solution for a multinational company. Employees frequently change departments, and you need to automate the assignment and removal of application access based on their current department. Which THREE Microsoft Entra features should you use?

Accepted Answer

Dynamic membership groups. Dynamic membership groups (A) are correct because they automatically add or remove users based on attribute values like 'department'. When an employee changes departments, their department attribute is updated, and the group membership is recalculated, granting or revoking access to applications assigned to that group. This is the core mechanism for automating access changes based on user attributes.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra self-service password reset

Question 15

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to design a monitoring solution to detect when users are assigned to high-privilege roles (e.g., Global Administrator) and ensure that any such assignment triggers an automated investigation. Additionally, you need to monitor sign-in failures for guest users and automatically block accounts after 5 failed attempts within 10 minutes. You have the following requirements: 1) Use a cloud-native solution that minimizes administrative overhead. 2) Integrate with Microsoft Sentinel for incident response. 3) Use built-in features where possible. What should you do?

Accepted Answer

Use Microsoft Entra Privileged Identity Management (PIM) alerts for role assignments and Microsoft Entra Identity Protection for sign-in risk policies; integrate both with Microsoft Sentinel.. Option C is correct because Microsoft Entra Privileged Identity Management (PIM) provides built-in alerts for high-privilege role assignments, and Microsoft Entra Identity Protection offers risk-based policies for sign-in failures, including user risk policies that can automatically block accounts after a specified number of failures. Both services natively integrate with Microsoft Sentinel via built-in data connectors, enabling automated incident creation with minimal administrative overhead, meeting all requirements.

Answer

Use Microsoft Entra audit logs streamed to Log Analytics, create Azure Logic Apps to detect role assignments and sign-in failures, and trigger Sentinel incidents.

Answer

Use Azure Policy to audit role assignments and create custom KQL functions in Log Analytics to detect sign-in failures, then forward to Sentinel.

Answer

Deploy Microsoft Identity Manager (MIM) on-premises to monitor role changes, and use Azure AD Connect Health for sign-in failures.

AZ-305 Design identity, governance, and monitoring solutions Practice Test 17 — 15 Questions

Exhibit

AZ-305 Design identity, governance, and monitoring solutions Practice Test 17 — 15 Questions

Exhibit