AZ-305 Design identity, governance, and monitoring solutions Practice Test 18 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID. You need to enforce multifactor authentication (MFA) for all guest users accessing a specific SharePoint Online site. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy targeting guest users and the SharePoint Online app.. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA specifically for guest users when they access the SharePoint Online app. This is the most efficient approach as it targets the exact user group (guests) and the specific application (SharePoint Online) without requiring per-user configuration or additional licensing overhead.

Answer

Use SharePoint site permissions to require MFA.

Answer

Enable MFA per-user for each guest account.

Answer

Configure Microsoft Entra Entitlement Management to require MFA.

Question 2

Refer to the exhibit. You are reviewing a Bicep template for a storage account. You need to ensure that the storage account is only accessible via HTTPS and uses TLS 1.2. Which property validates this requirement?

Accepted Answer

supportsHttpsTrafficOnly: true and minimumTlsVersion: TLS1_2. The `supportsHttpsTrafficOnly` property enforces that all traffic to the storage account must use HTTPS, and the `minimumTlsVersion` property set to `TLS1_2` ensures that only TLS 1.2 or higher is accepted. Together, these two properties satisfy the requirement of HTTPS-only access with TLS 1.2, as defined in the Azure Storage security baseline.

Answer

type: Microsoft.Storage/storageAccounts

Answer

accessTier: Hot

Answer

name: stprod001

Question 3

You are designing a governance strategy for Azure resources. The company has multiple departments, each requiring separate cost tracking and policy enforcement. You need to organize resources to align with the departments while minimizing management overhead. What should you use?

Accepted Answer

Management groups. Management groups are the correct choice because they allow you to organize Azure subscriptions into a hierarchy that aligns with your organizational structure, enabling you to apply Azure Policy and cost management controls at scale across multiple departments. By placing each department's subscriptions into separate management groups, you can enforce department-specific policies and track costs without managing each subscription individually, minimizing administrative overhead.

Answer

Azure Blueprints

Answer

Resource tags

Answer

Resource groups

Question 4

Which TWO of the following are true about Microsoft Entra ID Governance features?

Accepted Answer

Access reviews allow administrators to periodically review and attest to access rights.. Microsoft Entra ID Access Reviews enable administrators to periodically review and attest to the access rights of users, groups, or applications, ensuring that only authorized users retain access. This is a core governance feature that helps organizations meet compliance and security requirements by automating the certification process.

Answer

Conditional Access policies govern access based on location and device.

Answer

Privileged Identity Management (PIM) provides just-in-time access for all users.

Answer

Identity Protection automatically blocks all risky sign-ins.

Question 5

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that automatically blocks sign-ins from risky users and requires multi-factor authentication (MFA) when a sign-in risk is detected. Which TWO services should you use? (Choose two.)

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (B) is the service that detects sign-in risks (e.g., anonymous IP, atypical travel) and labels users or sign-ins as risky. Conditional Access policies (E) then enforce automated responses, such as blocking the sign-in or requiring MFA, based on the risk level from Entra ID Protection. Together, they provide the detection and enforcement mechanism described in the requirement.

Answer

Microsoft Purview

Answer

Microsoft Defender XDR

Answer

Microsoft Intune

Question 6

Your organization uses Azure Monitor to collect metrics from Azure resources. You need to create a custom metric alert that triggers when the average CPU usage of a specific virtual machine exceeds 80% for 10 minutes. Which TWO components are required? (Choose two.)

Accepted Answer

Metric alert rule. A metric alert rule is required because it defines the condition (average CPU > 80%) and the evaluation frequency (every 1 minute over a 10-minute aggregation window) that triggers the alert. Without the rule, Azure Monitor has no logic to evaluate the metric data and fire the alert.

Answer

Automation runbook

Answer

Log Analytics workspace

Answer

Diagnostic setting

Question 7

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to collect logs from on-premises firewalls and send them to Sentinel. Which TWO connectors can you use? (Choose two.)

Accepted Answer

Syslog. Syslog is a standard protocol for sending log messages from network devices, including firewalls, to a central collector. Common Event Format (CEF) is a syslog-based format that normalizes logs from different security products, making them easier to parse and analyze in Sentinel. Both connectors allow on-premises firewalls to forward their logs to a Log Analytics agent or AMA, which then sends them to Sentinel.

Answer

DNS

Answer

Azure Activity Log

Answer

Windows Security Events via AMA

Question 8

You are designing a governance strategy for an Azure environment that includes multiple subscriptions. The security team requires that all storage accounts must have HTTPS traffic only. Any non-compliant storage account must be automatically remediated. What is the most efficient solution?

Accepted Answer

Use Azure Policy with a DeployIfNotExists effect to enable HTTPS-only traffic. Azure Policy with a DeployIfNotExists effect can automatically remediate non-compliant storage accounts by enabling the 'HTTPS traffic only' property. This approach ensures continuous compliance without manual intervention, meeting the security team's requirement for automatic remediation.

Answer

Create an Azure Blueprint that includes a policy initiative

Answer

Assign a custom RBAC role that denies creation of storage accounts without HTTPS

Answer

Configure Azure Monitor alerts to notify the security team

Question 9

Which TWO actions should you take to implement a least-privilege identity strategy for Azure resources?

Accepted Answer

Use managed identities for Azure resources instead of service principals. Managed identities for Azure resources eliminate the need to store and manage credentials. Azure automatically rotates the identity's principal in Azure AD, and the resource can obtain an access token directly from the Azure Instance Metadata Service (IMDS) endpoint without any secrets. This aligns with the least-privilege principle by removing static, long-lived credentials and reducing the attack surface.

Answer

Assign Global Administrator role to all cloud architects

Answer

Store service principal passwords in Azure Key Vault and retrieve at runtime

Answer

Enable self-service password reset for all users

Question 10

Your organization has multiple Azure subscriptions managed through Azure Management Groups. You need to enforce a policy that requires all resources to have a 'CostCenter' tag. If a resource is created without the tag, the deployment should be denied. Additionally, you need to ensure that existing non-compliant resources are automatically remediated. Which combination of actions should you take?

Accepted Answer

Create a policy with Deny effect for new resources, and create a remediation task using a DeployIfNotExists policy for existing resources.. It combines two policy effects to address both requirements: the Deny effect blocks creation of new resources without the 'CostCenter' tag, while a separate DeployIfNotExists policy with a remediation task automatically adds the tag to existing non-compliant resources. This dual approach ensures enforcement for new deployments and automated remediation for existing resources, which is necessary because a single policy effect cannot both deny and remediate simultaneously.

Answer

Create a policy with DeployIfNotExists effect only, and rely on periodic evaluation.

Answer

Create a policy with Modify effect to add the tag, and assign it at the management group level.

Answer

Create a policy with Deny effect only, and run a script to tag existing resources.

Question 11

Your company uses Azure Policy to enforce compliance. You need to ensure that all storage accounts use HTTPS only. The policy should automatically remediate non-compliant storage accounts by enabling HTTPS-only. What policy effect should you use?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it not only evaluates whether storage accounts have the 'HTTPS only' setting enabled but also automatically deploys a remediation task to enable it when non-compliance is detected. This ensures continuous compliance without manual intervention, which aligns with the requirement for automatic remediation.

Answer

Deny

Answer

AuditIfNotExists

Answer

Append

Question 12

You are designing an identity lifecycle management solution for a multinational company. Employees frequently change departments, and you need to automate the assignment and removal of application access based on their current department. Which THREE Microsoft Entra features should you use?

Accepted Answer

Dynamic membership groups. Dynamic membership groups (A) are correct because they automatically add or remove users based on attribute values like 'department'. When an employee changes departments, their department attribute is updated, and the group membership is recalculated, granting or revoking access to applications assigned to that group. This is the core mechanism for automating access changes based on user attributes.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra self-service password reset

Question 13

Your company has multiple Azure subscriptions managed by different teams. You need to design a governance solution that ensures: 1) All subscriptions must have a consistent set of policies (e.g., allowed locations, allowed VM SKUs). 2) Compliance reports must be generated daily for each subscription. 3) Non-compliant resources must be automatically remediated where possible (e.g., add tags). 4) The solution must use a single management group hierarchy. What should you include in the design?

Accepted Answer

Create a management group hierarchy, assign Azure Policy at the root management group level with both 'audit' and 'deployIfNotExists' effects, and use a daily Logic App to query compliance via Azure Resource Graph and send reports.. Assigning Azure Policy at the root management group level ensures consistent policy enforcement across all subscriptions in the hierarchy. The 'deployIfNotExists' effect enables automatic remediation (e.g., adding missing tags), while a daily Logic App querying Azure Resource Graph can generate compliance reports without manual intervention. This design satisfies all requirements with a single management group hierarchy.

Answer

Create a management group hierarchy and use Azure Blueprints to assign policies and role assignments per subscription.

Answer

Use Azure DevOps to deploy a pipeline that runs PowerShell scripts to enforce policies and generate reports.

Answer

Create a custom Azure Policy initiative with all required policies and assign it to each subscription individually.

Question 14

Your company uses Microsoft Entra ID and has recently deployed Microsoft Sentinel. You need to design a monitoring solution to detect brute-force attacks against user accounts. The solution should use built-in analytics rules where possible and must trigger an automated response to temporarily disable the affected account. What should you include in the design?

Accepted Answer

Use the built-in 'Brute force attack against an Entra ID account' analytics rule in Microsoft Sentinel and connect a playbook to disable the user.. Microsoft Sentinel includes a built-in analytics rule specifically for detecting brute-force attacks against Microsoft Entra ID accounts. By connecting a playbook to this rule, you can automate the response to temporarily disable the affected user account, meeting the requirement for an automated response without custom development.

Answer

Use Microsoft Entra Identity Protection to detect brute-force and configure a conditional access policy to block sign-ins.

Answer

Stream sign-in logs to Log Analytics and create a scheduled query that alerts on multiple failures, then manually disable accounts.

Answer

Create a custom KQL query in Microsoft Sentinel and configure an automation rule to disable the account.

Question 15

You are designing a monitoring solution for a multi-region application deployed on Azure Virtual Machines and Azure SQL Database. The solution must provide a unified view of metrics and logs from all resources, detect anomalies using machine learning, and send alerts to the operations team. Which TWO capabilities should you include in the design?

Accepted Answer

Azure Application Insights. Azure Monitor is the core platform for collecting, analyzing, and acting on telemetry from Azure resources, including metrics and logs from VMs and SQL Database. Application Insights extends Azure Monitor with application performance management (APM) and built-in machine learning anomaly detection (e.g., Smart Detection) for proactive alerting. Together, they provide a unified monitoring view with ML-driven insights.

Answer

Azure Service Health

Answer

Azure Security Center

Answer

Azure Log Analytics