AZ-305 Design identity, governance, and monitoring solutions Practice Test 18 — 15 Questions

Question 1

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to design a solution to monitor changes to privileged groups in both directories and ensure that any unauthorized changes trigger an automated response. Which THREE services should you include in the design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel (A) is correct because it is the cloud-native SIEM/SOAR platform that ingests audit and directory logs from both Microsoft Entra ID and on-premises Active Directory (via connectors and agents), correlates privileged group change events, and uses analytics rules plus playbooks (Logic Apps) to trigger automated responses such as disabling accounts or notifying admins. Microsoft Entra Identity Protection (C) is correct because it detects risky sign-ins and risky users, including risk detections tied to privileged account compromise, and can feed those signals into Conditional Access or Sentinel so that unauthorized privileged activity is flagged and remediated automatically. Microsoft Defender for Identity (E) is correct because it monitors on-premises Active Directory Domain Services traffic and events (e.g., via the sensor on domain controllers) to detect suspicious changes to privileged groups such as Domain Admins, and it forwards alerts to Defender XDR/Sentinel for automated response. Microsoft Purview (B) is not included because it focuses on data governance, compliance, and information protection rather than real-time monitoring and automated response to directory privilege changes. Group Policy Management Console (D) is not included because it is an administrative tool for creating and managing GPOs, not a monitoring or automated-response service for privileged group modifications.

Answer

Microsoft Purview

Answer

Group Policy Management Console

Question 2

You are designing an identity lifecycle management solution for a multinational company. Employees frequently change departments, and you need to automate the assignment and removal of application access based on their current department. Which THREE Microsoft Entra features should you use?

Accepted Answer

Dynamic membership groups. Dynamic membership groups (A) are correct because they automatically add or remove users based on attribute values like 'department'. When an employee changes departments, their department attribute is updated, and the group membership is recalculated, granting or revoking access to applications assigned to that group. This is the core mechanism for automating access changes based on user attributes.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra self-service password reset

Question 3

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to design a monitoring solution to detect when users are assigned to high-privilege roles (e.g., Global Administrator) and ensure that any such assignment triggers an automated investigation. Additionally, you need to monitor sign-in failures for guest users and automatically block accounts after 5 failed attempts within 10 minutes. You have the following requirements: 1) Use a cloud-native solution that minimizes administrative overhead. 2) Integrate with Microsoft Sentinel for incident response. 3) Use built-in features where possible. What should you do?

Accepted Answer

Use Microsoft Entra Privileged Identity Management (PIM) alerts for role assignments and Microsoft Entra Identity Protection for sign-in risk policies; integrate both with Microsoft Sentinel.. Microsoft Entra Privileged Identity Management (PIM) provides built-in alerts for high-privilege role assignments, and Microsoft Entra Identity Protection offers risk-based policies for sign-in failures, including user risk policies that can automatically block accounts after a specified number of failures. Both services natively integrate with Microsoft Sentinel via built-in data connectors, enabling automated incident creation with minimal administrative overhead, meeting all requirements.

Answer

Use Microsoft Entra audit logs streamed to Log Analytics, create Azure Logic Apps to detect role assignments and sign-in failures, and trigger Sentinel incidents.

Answer

Use Azure Policy to audit role assignments and create custom KQL functions in Log Analytics to detect sign-in failures, then forward to Sentinel.

Answer

Deploy Microsoft Identity Manager (MIM) on-premises to monitor role changes, and use Azure AD Connect Health for sign-in failures.

Question 4

Your organization has a complex Azure environment with multiple subscriptions. You need to design a governance strategy that ensures: 1) All resources must have specific tags (CostCenter, Environment, Owner). 2) Any resource without required tags must be reported to the compliance team weekly. 3) Virtual machines must not be deployed in certain regions due to data sovereignty. 4) The solution must be automated and use native Azure services. You already have an Azure Log Analytics workspace and a central automation account. What should you include in the design?

Accepted Answer

Use Azure Policy with 'audit' effect for missing tags and region restriction; use Azure Logic Apps triggered by a schedule to query Azure Resource Graph and email the compliance report.. It uses Azure Policy with 'audit' effect to detect missing tags and region violations without blocking deployment, which satisfies the reporting requirement. Azure Logic Apps, triggered on a schedule, queries Azure Resource Graph to identify non-compliant resources and sends an email report to the compliance team weekly, fulfilling the automation and native service criteria without manual intervention.

Answer

Use Azure Resource Graph queries to find untagged resources and export to CSV manually each week.

Answer

Use Azure Blueprints to define tags and region restrictions; use Azure Monitor alerts to report non-compliance.

Answer

Use Azure Policy with 'deny' effect for missing tags and an Azure Automation runbook to add tags weekly.

Question 5

You are designing identity governance for a company that uses Microsoft Entra ID. The company wants to grant external partners access to an internal application for 90 days. After 90 days, access must be automatically removed. Additionally, the application requires that users have multi-factor authentication (MFA) and a compliant device. You need to design a solution that meets these requirements with minimal administrative effort. What should you do?

Accepted Answer

Create an access package in Microsoft Entra entitlement management with a 90-day policy and conditional access policies for MFA and device compliance.. Microsoft Entra entitlement management allows you to create an access package that automatically grants external partners access to the application for exactly 90 days, after which access is automatically removed via an expiration policy. Additionally, you can enforce multi-factor authentication (MFA) and device compliance by configuring conditional access policies that are applied to the access package, meeting all requirements with minimal administrative effort through automation.

Answer

Manually create guest user accounts, assign app, and set calendar reminder to delete after 90 days.

Answer

Create a dynamic group in Microsoft Entra ID that includes partners and assign the app; use a scheduled script to remove membership after 90 days.

Answer

Use Microsoft Entra Privileged Identity Management to grant just-in-time access for 90 days.

Question 6

Your company operates in a highly regulated industry and must retain all sign-in logs for 7 years. The logs must be immutable and cannot be modified or deleted by administrators. You need to design a monitoring solution that stores sign-in logs in a cost-effective manner while meeting compliance requirements. The solution should also allow for real-time analysis of sign-in activity. What should you include in the design?

Accepted Answer

Stream sign-in logs to Log Analytics for real-time analysis and simultaneously archive them to an Azure Storage account with immutable blob policy (WORM).. It meets both compliance and real-time analysis requirements. Streaming sign-in logs to Log Analytics enables real-time monitoring and querying, while simultaneously archiving them to an Azure Storage account with an immutable blob policy (WORM) ensures the logs cannot be modified or deleted for the required 7-year retention period. This combination provides cost-effective long-term storage (Azure Blob is cheaper than Log Analytics for long-term retention) and satisfies regulatory immutability mandates.

Answer

Stream sign-in logs to Azure Event Hubs and then to cold storage in Azure Blob with lifecycle management.

Answer

Stream sign-in logs to Log Analytics workspace with 7-year retention and use Azure Policy to restrict deletion.

Answer

Use Azure Data Explorer to store logs for 7 years and configure a purge policy to prevent deletion.

Question 7

Your company plans to deploy a new SaaS application that will be used by employees and external users. The application requires single sign-on (SSO) and must support conditional access policies that enforce MFA for external users. Additionally, the application must be able to read user profile attributes from Microsoft Entra ID. You need to design an identity solution that meets these requirements. What should you include in the design?

Accepted Answer

Register the application in Microsoft Entra ID (App Registration) and configure it to use OpenID Connect for authentication; apply conditional access policies to the app.. Registering the application in Microsoft Entra ID (App Registration) and configuring OpenID Connect (OIDC) enables SSO and allows the application to read user profile attributes via the Microsoft Graph API. Conditional access policies can be applied directly to the enterprise app in Entra ID to enforce MFA for external users, meeting all stated requirements.

Answer

Use Azure AD Application Proxy to publish the SaaS app and configure pre-authentication with Entra ID.

Answer

Use Microsoft Entra Domain Services to authenticate the application via LDAP.

Answer

Register the application in Microsoft Entra B2C and configure federation with your Entra ID tenant.

Question 8

Your company has a large Azure environment with thousands of resources. You need to design a solution to track resource ownership and ensure that resources are cleaned up when projects end. You want to use a tag-based approach where each resource has an 'Owner' and 'Project' tag. Additionally, you need to generate a weekly report of resources that are not tagged or have been orphaned (no recent activity). What should you include in the design?

Accepted Answer

Use Azure Resource Graph queries in an Azure Logic App scheduled to run weekly, and send the report via email.. Azure Resource Graph (ARG) provides fast, queryable access to resource properties across subscriptions, enabling efficient identification of untagged or orphaned resources. Scheduling an Azure Logic App to run ARG queries weekly and email the report meets the requirements for automation and delivery without additional infrastructure. This approach is cost-effective and scales well for thousands of resources.

Answer

Use Azure Policy to audit missing tags and create a custom dashboard in Azure Monitor.

Answer

Use Azure Monitor alerts with a metric alert for unmodified resources.

Answer

Use Azure Automation runbook to inventory resources and store in a SQL database, then use Power BI to report.

Question 9

Your company uses Microsoft Sentinel for security monitoring. You need to design a solution to detect when a user account is created in Microsoft Entra ID with Global Administrator privileges. When detected, an incident must be created in Sentinel and the account should be disabled temporarily until reviewed. You want to use built-in capabilities where possible. What should you do?

Accepted Answer

Use a Microsoft Sentinel analytics rule template for 'Suspicious Entra ID role assignment' and configure a playbook to disable the account via Microsoft Graph API.. It uses a built-in Sentinel analytics rule template specifically designed to detect suspicious Entra ID role assignments, which meets the requirement for built-in capabilities. The playbook, triggered by the rule, can use the Microsoft Graph API to disable the account temporarily, providing automated remediation without custom code or external services.

Answer

Use Microsoft Entra Privileged Identity Management to require approval for role activation, and audit logs to detect permanent assignments.

Answer

Use Microsoft Defender for Cloud Apps to monitor for privileged role assignments and send an alert to Sentinel.

Answer

Create a custom KQL query in Log Analytics and schedule it as a Sentinel analytics rule, then use an Azure Function to disable the account.

Question 10

Your company has multiple Azure subscriptions managed by different teams. You need to design a governance solution that ensures: 1) All subscriptions must have a consistent set of policies (e.g., allowed locations, allowed VM SKUs). 2) Compliance reports must be generated daily for each subscription. 3) Non-compliant resources must be automatically remediated where possible (e.g., add tags). 4) The solution must use a single management group hierarchy. What should you include in the design?

Accepted Answer

Create a management group hierarchy, assign Azure Policy at the root management group level with both 'audit' and 'deployIfNotExists' effects, and use a daily Logic App to query compliance via Azure Resource Graph and send reports.. Assigning Azure Policy at the root management group level ensures consistent policy enforcement across all subscriptions in the hierarchy. The 'deployIfNotExists' effect enables automatic remediation (e.g., adding missing tags), while a daily Logic App querying Azure Resource Graph can generate compliance reports without manual intervention. This design satisfies all requirements with a single management group hierarchy.

Answer

Create a management group hierarchy and use Azure Blueprints to assign policies and role assignments per subscription.

Answer

Use Azure DevOps to deploy a pipeline that runs PowerShell scripts to enforce policies and generate reports.

Answer

Create a custom Azure Policy initiative with all required policies and assign it to each subscription individually.

Question 11

Your company uses Microsoft Entra ID and has recently deployed Microsoft Sentinel. You need to design a monitoring solution to detect brute-force attacks against user accounts. The solution should use built-in analytics rules where possible and must trigger an automated response to temporarily disable the affected account. What should you include in the design?

Accepted Answer

Use the built-in 'Brute force attack against an Entra ID account' analytics rule in Microsoft Sentinel and connect a playbook to disable the user.. Microsoft Sentinel includes a built-in analytics rule specifically for detecting brute-force attacks against Microsoft Entra ID accounts. By connecting a playbook to this rule, you can automate the response to temporarily disable the affected user account, meeting the requirement for an automated response without custom development.

Answer

Use Microsoft Entra Identity Protection to detect brute-force and configure a conditional access policy to block sign-ins.

Answer

Stream sign-in logs to Log Analytics and create a scheduled query that alerts on multiple failures, then manually disable accounts.

Answer

Create a custom KQL query in Microsoft Sentinel and configure an automation rule to disable the account.

Question 12

You are designing a monitoring solution for a multi-region application deployed on Azure Virtual Machines and Azure SQL Database. The solution must provide a unified view of metrics and logs from all resources, detect anomalies using machine learning, and send alerts to the operations team. Which TWO capabilities should you include in the design?

Accepted Answer

Azure Application Insights. Azure Monitor is the core platform for collecting, analyzing, and acting on telemetry from Azure resources, including metrics and logs from VMs and SQL Database. Application Insights extends Azure Monitor with application performance management (APM) and built-in machine learning anomaly detection (e.g., Smart Detection) for proactive alerting. Together, they provide a unified monitoring view with ML-driven insights.

Answer

Azure Service Health

Answer

Azure Security Center

Answer

Azure Log Analytics

Question 13

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to design a solution to monitor changes to privileged groups in both directories and ensure that any unauthorized changes trigger an automated response. Which THREE services should you include in the design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Microsoft Entra ID Protection to detect risky sign-ins and create a conditional access policy that requires MFA for sensitive apps. Enable the risky user policy to require password change, and use Microsoft Authenticator for self-remediation.. It uses Microsoft Entra ID Protection to detect risky sign-ins and a Conditional Access policy to require MFA for sensitive applications, meeting the MFA enforcement requirement. The risky user policy requiring a password change combined with Microsoft Authenticator for self-remediation allows users to resolve their own risk without admin intervention, satisfying the self-remediation requirement. This approach minimizes infrastructure complexity by relying entirely on cloud-native services rather than on-premises components.

Answer

Deploy Azure AD Domain Services and configure Kerberos authentication for cloud apps. Use Azure MFA Server on-premises for MFA enforcement.

Answer

Implement Microsoft Defender for Identity to monitor on-premises AD and require MFA via on-premises NPS extension.

Answer

Use Microsoft Entra Permissions Management to enforce MFA policies and manage user permissions.

Question 14

Your organization has 500 users in Microsoft Entra ID. You need to ensure that users can only access Microsoft 365 apps from compliant devices (compliant with Intune policies). Users are already enrolled in Intune. The compliance policies are defined. You need to configure the access control mechanism. What should you do?

Accepted Answer

Create a Conditional Access policy that requires device to be marked as compliant.. Conditional Access in Microsoft Entra ID is the mechanism that enforces access controls based on signals like device compliance. By creating a policy that requires the device to be marked as compliant, you ensure that only devices meeting Intune compliance policies can access Microsoft 365 apps. This directly addresses the requirement without blocking all access or relying on automatic revocation.

Answer

Create a Conditional Access policy that blocks all access and then create exclusions for compliant devices.

Answer

Configure Intune compliance policies to automatically revoke access for non-compliant devices.

Answer

Create a Conditional Access policy that requires MFA based on location.

Question 15

Your company runs a mission-critical application on Azure Virtual Machines in a single region. You need to design a monitoring solution that provides proactive alerts for performance degradation and allows the operations team to analyze historical trends. The solution must minimize cost and operational overhead. You have an existing Log Analytics workspace. What should you include in the design?

Accepted Answer

Enable Azure Monitor on all VMs using the Azure Monitor agent. Create metric alerts for high CPU and memory usage. Use Log Analytics to query and analyze historical performance data.. It uses the Azure Monitor agent to collect performance data from VMs, enabling metric alerts for proactive notification of high CPU and memory usage, while leveraging the existing Log Analytics workspace for cost-effective historical analysis. This approach minimizes operational overhead by using a single agent and native Azure Monitor features without additional services or complex configurations.

Answer

Enable VM insights in Azure Monitor and use its live map and performance views for historical analysis.

Answer

Configure Azure Autoscale for the VMs based on CPU metrics and use Azure Monitor for logging.

Answer

Deploy Application Insights on each VM and use its built-in alerts for performance.