AZ-305 Design identity, governance, and monitoring solutions Practice Test 2 — 15 Questions

Question 1

Your company has multiple Azure subscriptions managed by a management group. You need to enforce that all resources are deployed in the West US region only. Additionally, you must allow a specific resource group in the production subscription to be deployed in East US. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign a policy at the management group level that denies all locations except West US, and create a policy exemption for the specific resource group.. Assigning a policy at the management group level that denies all locations except West US (C) enforces the restriction across all subscriptions. Creating a policy exemption for the specific resource group allows that resource group to deploy in East US, overriding the inherited policy. This is the correct way to handle exceptions in Azure Policy.

Answer

Assign a policy at the management group level that denies all locations except West US, and assign a separate policy at the subscription level that allows East US.

Answer

Assign a policy at each subscription level allowing only West US, and grant the resource group owner role to bypass.

Answer

Use Azure Blueprints to assign a policy at the management group and then edit the blueprint for the exception.

Question 2

Refer to the exhibit. You have an Azure Policy definition as shown. The policy is assigned at the subscription scope. What is the result when a user tries to create a VM with SKU Standard_D8s_v3?

Accepted Answer

The VM creation is denied.. The Azure Policy definition shown uses a 'Deny' effect for VM SKUs that do not match the allowed list. Since Standard_D8s_v3 is not in the allowed list (which includes Standard_D2s_v3, Standard_D4s_v3, and Standard_D8s_v3), the policy denies the VM creation. The 'Deny' effect prevents the resource from being created and logs a denial event in the activity log.

Answer

The VM is created successfully.

Answer

The VM is created but flagged as non-compliant.

Answer

The VM SKU is automatically changed to Standard_D4s_v3.

Question 3

Refer to the exhibit. You run the KQL query in Azure Monitor Log Analytics. Which user accounts should you investigate first?

Accepted Answer

Users with more than 5 medium-risk sign-ins in the last day.. The KQL query filters for sign-ins where RiskLevelDuringSignIn equals 'medium' and then summarizes by UserPrincipalName, counting occurrences. Users with more than 5 medium-risk sign-ins in the last day indicate a pattern of suspicious activity that warrants immediate investigation, as medium-risk sign-ins often correspond to atypical travel, anonymous IPs, or unfamiliar properties, but the query specifically targets the count threshold as the trigger for escalation.

Answer

Users with the highest number of sign-in attempts.

Answer

Users who had sign-ins from anonymous IP addresses.

Answer

Users who have unfamiliar features in their sign-ins.

Question 4

Refer to the exhibit. You are analyzing a deployment of a Custom Script Extension on an Azure VM. The extension fails to run. What is the most likely cause?

Accepted Answer

The 'protectedSettings' property is misconfigured.. The Custom Script Extension on Azure VMs requires the `commandToExecute` parameter to be placed in the `protectedSettings` property when the script URL or command contains sensitive information (e.g., storage account keys). If `commandToExecute` is incorrectly placed in the `publicSettings` property instead, or if the `protectedSettings` JSON structure is malformed (e.g., missing the required `commandToExecute` key or using an incorrect casing), the extension will fail to run because it cannot parse the execution command. This is a common misconfiguration that causes the extension to report a failure status without executing the script.

Answer

The VM agent is not installed.

Answer

The VM has no outbound internet connectivity.

Answer

The extension type is incorrect.

Question 5

You have an Azure subscription that contains a virtual network named VNet1. You need to monitor all network security group (NSG) flow logs. Which three components must you enable? (Select THREE.)

Accepted Answer

Azure Network Watcher. Network security group flow logs must be explicitly enabled on the NSG to capture IP traffic data. Without enabling this feature, no flow log data is generated regardless of other components. The question asks which components must be enabled, and enabling NSG flow logs is the direct action that starts logging.

Answer

Log Analytics workspace

Answer

Traffic Analytics

Question 6

Your organization has a hybrid identity with Microsoft Entra ID and on-premises Active Directory. You need to allow users to reset their own passwords from the cloud. What should you configure?

Accepted Answer

Azure AD self-service password reset with password writeback. Microsoft Entra ID self-service password reset (SSPR) with password writeback is the correct configuration because it allows users to reset their on-premises Active Directory passwords from the cloud. Password writeback ensures that the new password is written back to the on-premises AD, maintaining hybrid identity synchronization. Without writeback, cloud-only password resets would not update the on-premises directory, breaking the hybrid identity model.

Answer

Password hash synchronization only

Answer

Azure AD Connect with password hash sync

Answer

Pass-through authentication

Question 7

You need to assign permissions to an Azure resource group so that a user can create and manage virtual machines but cannot delete the resource group. What should you use?

Accepted Answer

Assign the Contributor role at the resource group level.. The Contributor role at the resource group level grants full management access to all resources within the resource group, including creating and managing virtual machines, but explicitly prevents the user from deleting the resource group itself. This meets the requirement because the Contributor role cannot perform management operations on the resource group scope, such as deletion, which is reserved for the Owner role.

Answer

Assign the Owner role at the resource group level.

Answer

Assign the Reader role at the resource group level.

Answer

Assign the User Access Administrator role at the resource group level.

Question 8

Refer to the exhibit. You apply this Azure Policy to a subscription. What happens when a user tries to create a virtual machine?

Accepted Answer

The creation of the virtual machine is denied.. The Azure Policy in the exhibit uses the 'deny' effect, which explicitly blocks any operation that does not comply with the policy rule. When a user attempts to create a virtual machine, Azure Resource Manager evaluates the policy before provisioning the resource. If the VM creation request does not meet the conditions defined in the policy (e.g., requiring a specific tag or location), the request is denied and the VM is not created. This is why option C is correct.

Answer

The virtual machine is created, and an audit event is logged.

Answer

The virtual machine is created only if it has a specific tag.

Answer

The virtual machine is created only in a specific location.

Question 9

Your company is designing a governance strategy for Azure resources. The security team requires that all resource groups in the production subscription must have a specific tag (Environment=Production) applied automatically. Any resource group created without this tag must be reported within 24 hours. Which Azure policy should you implement?

Accepted Answer

Create a policy with effect 'modify' to add the tag using a managed identity.. The 'modify' effect automatically adds the required tag to resource groups during creation, ensuring the tag is applied automatically. Additionally, Azure Policy can report non-compliant resource groups through compliance evaluation, and if any resource group is created without the tag, it will be flagged as non-compliant until the tag is added. With a remediation task, the tag can be added automatically, and the compliance report will show the status within 24 hours. Option C ('deny') blocks creation but does not automatically apply the tag, and option B ('append') adds the tag but does not provide a built-in reporting mechanism. Option A ('audit') only reports non-compliance without applying the tag automatically.

Answer

Create a policy with effect 'audit' to report non-compliant resource groups.

Answer

Create a policy with effect 'append' to add the missing tag automatically.

Answer

Create a policy with effect 'deny' on the missing tag condition.

Question 10

Your company uses Microsoft Entra ID (formerly Azure AD) and requires that all external guest users must be automatically reviewed for access every 90 days. The review should be performed by the guest user's manager in the partner organization. However, the partner organization does not use Microsoft Entra ID. Which solution should you implement?

Accepted Answer

Configure Microsoft Entra ID access reviews to ask the guest user to self-attest their access every 90 days.. Microsoft Entra ID access reviews can be configured to require guest users to self-attest their access. This is the only viable solution when the guest user's organization does not use Microsoft Entra ID, as there is no external manager identity to assign the review to. The self-attestation process allows the guest user to confirm whether they still need access, and the review can be set to recur every 90 days as required.

Answer

Create a custom Azure Logic App to send email reminders and manually track access expiration.

Answer

Configure Microsoft Entra ID access reviews to include guest users and assign the review to the guest user's external manager.

Answer

Use Azure AD B2C to manage guest identities and set up a custom review process.

Question 11

You are designing a governance strategy for a multi-subscription Azure environment. Your compliance team requires that any resource group created in the production subscription must have a specific naming convention: it must start with 'prod-' and be followed by a three-letter department code and a two-digit number. Any resource group not following this convention should be automatically prevented from creation. Which Azure policy definition should you use?

Accepted Answer

Use a policy with 'pattern' constraint on the 'name' field.. Azure Policy's 'pattern' constraint uses regular expressions to enforce complex naming conventions. The requirement for resource groups to start with 'prod-', followed by a three-letter department code and a two-digit number, is a pattern that can be precisely defined with a regex like '^prod-[a-z]{3}\d{2}$'. The 'pattern' constraint is the only option that supports regex-based validation, making it suitable for this multi-part naming rule.

Answer

Use a policy with 'like' constraint on the 'name' field.

Answer

Use a policy with 'match' constraint on the 'name' field.

Answer

Use a policy with 'contains' constraint on the 'name' field.

Question 12

Your organization uses Microsoft Sentinel for security monitoring. You need to ensure that all sign-in logs from Microsoft Entra ID are ingested into a Log Analytics workspace in real time. Which diagnostic setting should you configure?

Accepted Answer

SignInLogs. The SignInLogs diagnostic setting captures all user sign-in activities, including interactive and non-interactive sign-ins, which is required for real-time ingestion of all sign-in logs from Microsoft Entra ID into a Log Analytics workspace. This setting ensures that every authentication event is streamed to Sentinel for security monitoring without delay.

Answer

NonInteractiveUserSignInLogs

Answer

AuditLogs

Answer

ServicePrincipalSignInLogs

Question 13

Your organization uses Azure Policy to enforce tagging standards. You need to ensure that any resource created without the required 'CostCenter' tag is automatically remediated by adding the tag with a default value. Which policy effect should you use?

Accepted Answer

modify. The 'modify' effect in Azure Policy is specifically designed to add, update, or remove properties or tags on resources during creation or update, and it can also remediate existing resources via a remediation task. It uses an alias like 'tags['CostCenter']' to target the tag and can apply a default value when the tag is missing. This makes it the only effect that both enforces the tag and automatically corrects non-compliant resources.

Answer

append

Answer

deny

Answer

audit

Question 14

Your company is migrating on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate using their existing on-premises passwords and that password changes are synchronized immediately. The solution must minimize latency and avoid storing password hashes in the cloud. What should you implement?

Accepted Answer

Implement password hash synchronization with password writeback. Password hash synchronization with writeback ensures that password changes are synchronized immediately with low latency. While it stores password hashes in Microsoft Entra ID, this is done using a secure salted hash that is not reversible, and the hash synchronization provides near-instant synchronization. Pass-through Authentication does not store password hashes in the cloud but requires additional infrastructure and does not provide immediate password change synchronization from on-premises to cloud without additional components. Cloud-only accounts would require new passwords, and AD FS would rely on federation without immediate synchronization. Therefore, password hash synchronization with writeback is the best fit for the stated requirements.

Answer

Implement Microsoft Entra Pass-through Authentication

Answer

Create cloud-only user accounts in Microsoft Entra ID

Answer

Federate with Active Directory Federation Services (AD FS)

Question 15

Your company uses Microsoft Intune for device management. You need to ensure that only devices that are compliant with security policies can access corporate resources. The solution must also support legacy authentication protocols. What should you implement?

Accepted Answer

Conditional Access policies with 'Require device to be marked as compliant'. The requirement is to enforce compliance-based access control for devices managed by Microsoft Intune, while also supporting legacy authentication protocols. Conditional Access policies with 'Require device to be marked as compliant' evaluate the device's compliance status reported by Intune and can block or allow access based on that status. This works with legacy authentication protocols (e.g., POP3, IMAP, SMTP) when combined with a compliance policy that does not require modern authentication, though legacy protocols are inherently less secure and should be used cautiously.

Answer

Microsoft Defender for Endpoint

Answer

Device-based Conditional Access with 'Require hybrid Azure AD joined device'

Answer

Microsoft Entra application proxy