AZ-305 Design identity, governance, and monitoring solutions Practice Test 18 — 15 Questions

Question 1

Your organization has a complex Azure environment with multiple subscriptions. You need to design a governance strategy that ensures: 1) All resources must have specific tags (CostCenter, Environment, Owner). 2) Any resource without required tags must be reported to the compliance team weekly. 3) Virtual machines must not be deployed in certain regions due to data sovereignty. 4) The solution must be automated and use native Azure services. You already have an Azure Log Analytics workspace and a central automation account. What should you include in the design?

Accepted Answer

Use Azure Policy with 'audit' effect for missing tags and region restriction; use Azure Logic Apps triggered by a schedule to query Azure Resource Graph and email the compliance report.. Option D is correct because it uses Azure Policy with 'audit' effect to detect missing tags and region violations without blocking deployment, which satisfies the reporting requirement. Azure Logic Apps, triggered on a schedule, queries Azure Resource Graph to identify non-compliant resources and sends an email report to the compliance team weekly, fulfilling the automation and native service criteria without manual intervention.

Answer

Use Azure Resource Graph queries to find untagged resources and export to CSV manually each week.

Answer

Use Azure Blueprints to define tags and region restrictions; use Azure Monitor alerts to report non-compliance.

Answer

Use Azure Policy with 'deny' effect for missing tags and an Azure Automation runbook to add tags weekly.

Question 2

You are designing identity governance for a company that uses Microsoft Entra ID. The company wants to grant external partners access to an internal application for 90 days. After 90 days, access must be automatically removed. Additionally, the application requires that users have multi-factor authentication (MFA) and a compliant device. You need to design a solution that meets these requirements with minimal administrative effort. What should you do?

Accepted Answer

Create an access package in Microsoft Entra entitlement management with a 90-day policy and conditional access policies for MFA and device compliance.. Option A is correct because Microsoft Entra entitlement management allows you to create an access package that automatically grants external partners access to the application for exactly 90 days, after which access is automatically removed via an expiration policy. Additionally, you can enforce multi-factor authentication (MFA) and device compliance by configuring conditional access policies that are applied to the access package, meeting all requirements with minimal administrative effort through automation.

Answer

Manually create guest user accounts, assign app, and set calendar reminder to delete after 90 days.

Answer

Create a dynamic group in Microsoft Entra ID that includes partners and assign the app; use a scheduled script to remove membership after 90 days.

Answer

Use Microsoft Entra Privileged Identity Management to grant just-in-time access for 90 days.

Question 3

Your company operates in a highly regulated industry and must retain all sign-in logs for 7 years. The logs must be immutable and cannot be modified or deleted by administrators. You need to design a monitoring solution that stores sign-in logs in a cost-effective manner while meeting compliance requirements. The solution should also allow for real-time analysis of sign-in activity. What should you include in the design?

Accepted Answer

Stream sign-in logs to Log Analytics for real-time analysis and simultaneously archive them to an Azure Storage account with immutable blob policy (WORM).. Option A is correct because it meets both compliance and real-time analysis requirements. Streaming sign-in logs to Log Analytics enables real-time monitoring and querying, while simultaneously archiving them to an Azure Storage account with an immutable blob policy (WORM) ensures the logs cannot be modified or deleted for the required 7-year retention period. This combination provides cost-effective long-term storage (Azure Blob is cheaper than Log Analytics for long-term retention) and satisfies regulatory immutability mandates.

Answer

Stream sign-in logs to Azure Event Hubs and then to cold storage in Azure Blob with lifecycle management.

Answer

Stream sign-in logs to Log Analytics workspace with 7-year retention and use Azure Policy to restrict deletion.

Answer

Use Azure Data Explorer to store logs for 7 years and configure a purge policy to prevent deletion.

Question 4

Your company plans to deploy a new SaaS application that will be used by employees and external users. The application requires single sign-on (SSO) and must support conditional access policies that enforce MFA for external users. Additionally, the application must be able to read user profile attributes from Microsoft Entra ID. You need to design an identity solution that meets these requirements. What should you include in the design?

Accepted Answer

Register the application in Microsoft Entra ID (App Registration) and configure it to use OpenID Connect for authentication; apply conditional access policies to the app.. Option A is correct because registering the application in Microsoft Entra ID (App Registration) and configuring OpenID Connect (OIDC) enables SSO and allows the application to read user profile attributes via the Microsoft Graph API. Conditional access policies can be applied directly to the enterprise app in Entra ID to enforce MFA for external users, meeting all stated requirements.

Answer

Use Azure AD Application Proxy to publish the SaaS app and configure pre-authentication with Entra ID.

Answer

Use Microsoft Entra Domain Services to authenticate the application via LDAP.

Answer

Register the application in Microsoft Entra B2C and configure federation with your Entra ID tenant.

Question 5

Your company has a large Azure environment with thousands of resources. You need to design a solution to track resource ownership and ensure that resources are cleaned up when projects end. You want to use a tag-based approach where each resource has an 'Owner' and 'Project' tag. Additionally, you need to generate a weekly report of resources that are not tagged or have been orphaned (no recent activity). What should you include in the design?

Accepted Answer

Use Azure Resource Graph queries in an Azure Logic App scheduled to run weekly, and send the report via email.. Option C is correct because Azure Resource Graph can query all resources and their tags, and Azure Logic Apps can schedule the query and send a report via email. Option A is wrong because Azure Policy can enforce tags but does not generate reports natively. Option B is wrong because Azure Monitor alerts are for real-time notifications, not scheduled reports. Option D is wrong because Azure Automation runbooks can do this but are more complex than Logic Apps.

Answer

Use Azure Policy to audit missing tags and create a custom dashboard in Azure Monitor.

Answer

Use Azure Monitor alerts with a metric alert for unmodified resources.

Answer

Use Azure Automation runbook to inventory resources and store in a SQL database, then use Power BI to report.

Question 6

Your company uses Microsoft Sentinel for security monitoring. You need to design a solution to detect when a user account is created in Microsoft Entra ID with Global Administrator privileges. When detected, an incident must be created in Sentinel and the account should be disabled temporarily until reviewed. You want to use built-in capabilities where possible. What should you do?

Accepted Answer

Use a Microsoft Sentinel analytics rule template for 'Suspicious Entra ID role assignment' and configure a playbook to disable the account via Microsoft Graph API.. Option C is correct because it uses a built-in Sentinel analytics rule template specifically designed to detect suspicious Entra ID role assignments, which meets the requirement for built-in capabilities. The playbook, triggered by the rule, can use the Microsoft Graph API to disable the account temporarily, providing automated remediation without custom code or external services.

Answer

Use Microsoft Entra Privileged Identity Management to require approval for role activation, and audit logs to detect permanent assignments.

Answer

Use Microsoft Defender for Cloud Apps to monitor for privileged role assignments and send an alert to Sentinel.

Answer

Create a custom KQL query in Log Analytics and schedule it as a Sentinel analytics rule, then use an Azure Function to disable the account.

Question 7

Your company has multiple Azure subscriptions managed by different teams. You need to design a governance solution that ensures: 1) All subscriptions must have a consistent set of policies (e.g., allowed locations, allowed VM SKUs). 2) Compliance reports must be generated daily for each subscription. 3) Non-compliant resources must be automatically remediated where possible (e.g., add tags). 4) The solution must use a single management group hierarchy. What should you include in the design?

Accepted Answer

Create a management group hierarchy, assign Azure Policy at the root management group level with both 'audit' and 'deployIfNotExists' effects, and use a daily Logic App to query compliance via Azure Resource Graph and send reports.. Option A is correct because assigning Azure Policy at the root management group level ensures consistent policy enforcement across all subscriptions in the hierarchy. The 'deployIfNotExists' effect enables automatic remediation (e.g., adding missing tags), while a daily Logic App querying Azure Resource Graph can generate compliance reports without manual intervention. This design satisfies all requirements with a single management group hierarchy.

Answer

Create a management group hierarchy and use Azure Blueprints to assign policies and role assignments per subscription.

Answer

Use Azure DevOps to deploy a pipeline that runs PowerShell scripts to enforce policies and generate reports.

Answer

Create a custom Azure Policy initiative with all required policies and assign it to each subscription individually.

Question 8

Your company uses Microsoft Entra ID and has recently deployed Microsoft Sentinel. You need to design a monitoring solution to detect brute-force attacks against user accounts. The solution should use built-in analytics rules where possible and must trigger an automated response to temporarily disable the affected account. What should you include in the design?

Accepted Answer

Use the built-in 'Brute force attack against an Entra ID account' analytics rule in Microsoft Sentinel and connect a playbook to disable the user.. Option A is correct because Microsoft Sentinel includes a built-in analytics rule specifically for detecting brute-force attacks against Microsoft Entra ID accounts. By connecting a playbook to this rule, you can automate the response to temporarily disable the affected user account, meeting the requirement for an automated response without custom development.

Answer

Use Microsoft Entra Identity Protection to detect brute-force and configure a conditional access policy to block sign-ins.

Answer

Stream sign-in logs to Log Analytics and create a scheduled query that alerts on multiple failures, then manually disable accounts.

Answer

Create a custom KQL query in Microsoft Sentinel and configure an automation rule to disable the account.

Question 9

You are designing a monitoring solution for a multi-region application deployed on Azure Virtual Machines and Azure SQL Database. The solution must provide a unified view of metrics and logs from all resources, detect anomalies using machine learning, and send alerts to the operations team. Which TWO capabilities should you include in the design?

Accepted Answer

Azure Application Insights. Azure Monitor is the core platform for collecting, analyzing, and acting on telemetry from Azure resources, including metrics and logs from VMs and SQL Database. Application Insights extends Azure Monitor with application performance management (APM) and built-in machine learning anomaly detection (e.g., Smart Detection) for proactive alerting. Together, they provide a unified monitoring view with ML-driven insights.

Answer

Azure Service Health

Answer

Azure Security Center

Answer

Azure Log Analytics

Question 10

Your company has a hybrid identity environment with 10,000 on-premises users synchronized to Microsoft Entra ID using Microsoft Entra Connect. You plan to implement a modern access control strategy for all cloud applications. The requirements are: enforce multifactor authentication (MFA) for all users when accessing sensitive applications, allow users to self-remediate risky sign-ins via a mobile app, and minimize infrastructure complexity. You need to design the identity and governance solution. What should you do?

Accepted Answer

Configure Microsoft Entra ID Protection to detect risky sign-ins and create a conditional access policy that requires MFA for sensitive apps. Enable the risky user policy to require password change, and use Microsoft Authenticator for self-remediation.. Option B is correct because it uses Microsoft Entra ID Protection to detect risky sign-ins and a Conditional Access policy to require MFA for sensitive applications, meeting the MFA enforcement requirement. The risky user policy requiring a password change combined with Microsoft Authenticator for self-remediation allows users to resolve their own risk without admin intervention, satisfying the self-remediation requirement. This approach minimizes infrastructure complexity by relying entirely on cloud-native services rather than on-premises components.

Answer

Deploy Azure AD Domain Services and configure Kerberos authentication for cloud apps. Use Azure MFA Server on-premises for MFA enforcement.

Answer

Implement Microsoft Defender for Identity to monitor on-premises AD and require MFA via on-premises NPS extension.

Answer

Use Microsoft Entra Permissions Management to enforce MFA policies and manage user permissions.

Question 11

Your organization has 500 users in Microsoft Entra ID. You need to ensure that users can only access Microsoft 365 apps from compliant devices (compliant with Intune policies). Users are already enrolled in Intune. The compliance policies are defined. You need to configure the access control mechanism. What should you do?

Accepted Answer

Create a Conditional Access policy that requires device to be marked as compliant.. Option C is correct because Conditional Access in Microsoft Entra ID is the mechanism that enforces access controls based on signals like device compliance. By creating a policy that requires the device to be marked as compliant, you ensure that only devices meeting Intune compliance policies can access Microsoft 365 apps. This directly addresses the requirement without blocking all access or relying on automatic revocation.

Answer

Create a Conditional Access policy that blocks all access and then create exclusions for compliant devices.

Answer

Configure Intune compliance policies to automatically revoke access for non-compliant devices.

Answer

Create a Conditional Access policy that requires MFA based on location.

Question 12

Your company runs a mission-critical application on Azure Virtual Machines in a single region. You need to design a monitoring solution that provides proactive alerts for performance degradation and allows the operations team to analyze historical trends. The solution must minimize cost and operational overhead. You have an existing Log Analytics workspace. What should you include in the design?

Accepted Answer

Enable Azure Monitor on all VMs using the Azure Monitor agent. Create metric alerts for high CPU and memory usage. Use Log Analytics to query and analyze historical performance data.. Option D is correct because it uses the Azure Monitor agent to collect performance data from VMs, enabling metric alerts for proactive notification of high CPU and memory usage, while leveraging the existing Log Analytics workspace for cost-effective historical analysis. This approach minimizes operational overhead by using a single agent and native Azure Monitor features without additional services or complex configurations.

Answer

Enable VM insights in Azure Monitor and use its live map and performance views for historical analysis.

Answer

Configure Azure Autoscale for the VMs based on CPU metrics and use Azure Monitor for logging.

Answer

Deploy Application Insights on each VM and use its built-in alerts for performance.

Question 13

Your organization is deploying a critical application in Azure that must maintain an uptime SLA of 99.99%. The application runs on Azure Virtual Machines in a single region. You need to design a monitoring solution that alerts the operations team within 5 minutes of any VM unavailability. The solution must minimize false positives and avoid alert fatigue. What should you include in the design?

Accepted Answer

Configure Azure Monitor VM insights with availability metric alerts set to fire when the VM is unavailable for 2 out of the last 5 minutes.. Option D is correct because availability metrics from Azure Monitor provide accurate unavailability detection with minimal false positives, and multi-metric alerts reduce noise. Option A is wrong because Activity Log alerts only fire on configuration changes, not on VM unavailability itself. Option B is wrong because Service Health alerts cover Azure service incidents but not VM-level failures. Option C is wrong because Log Analytics agent-based heartbeat alerts can have delays and require additional configuration, and single-metric alerts may cause alert fatigue.

Answer

Create an Azure Service Health alert for the 'Virtual machine' service.

Answer

Create an Azure Monitor alert based on the Activity Log for 'Virtual Machine Guest OS Unresponsive' events.

Answer

Deploy the Log Analytics agent on each VM and create an alert for when heartbeat data is missing for 5 minutes.

Question 14

Your company has a Microsoft Entra ID tenant with 10,000 users. You are designing an identity governance solution to automate user access reviews for critical applications. The compliance team requires that access reviews be conducted quarterly and that any reviewer who does not respond within 7 days have their decisions auto-approved. You need to implement the solution using Microsoft Entra ID Governance. What should you do?

Accepted Answer

Create an access review with 'Auto approve' after 7 days of no response.. Option B is correct because access reviews with auto-approve after 7 days meets the requirement. Option A is wrong because auto-deny would revoke access, not approve. Option C is wrong because PIM is for privileged roles, not general access reviews. Option D is wrong because recurring campaigns in Microsoft Purview are for data classification, not access reviews.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) to require activation for access to critical applications.

Answer

Create an access review with 'Auto deny' after 7 days of no response.

Answer

Create a recurring campaign in Microsoft Purview Compliance Manager.

Question 15

You are designing a monitoring solution for a cloud-native application that uses Azure Functions, Azure Storage, and Azure Cosmos DB. The solution must provide centralized log collection and analysis, enable proactive alerting on application errors, and support long-term log retention for compliance (7 years). What should you include in the design?

Accepted Answer

Configure diagnostic settings for each Azure resource to send logs and metrics to a Log Analytics workspace.. Option A is correct because Azure Log Analytics workspace provides centralized log storage, analysis, and retention up to 7 years. Option B is wrong because Application Insights is for application performance monitoring, not long-term retention. Option C is wrong because Azure Monitor Metrics store numeric data only, not logs. Option D is wrong because Azure Storage with archive tier is for raw log files, not analysis.

Answer

Use Azure Storage with cool tier for logs and enable Azure Storage Analytics logs.

Answer

Store logs in Azure Monitor Metrics with a retention of 93 days.

Answer

Use Application Insights to collect logs and set retention to 90 days, then export to Azure Blob Storage for archival.