AZ-305 Design identity, governance, and monitoring solutions Practice Test 3 — 15 Questions

Question 1

A company uses Microsoft Entra ID. They want to allow users to sign in to partner applications using their Microsoft Entra ID credentials. The partner applications support SAML 2.0 and OpenID Connect. They also need to customize the appearance of the sign-in pages. Which Microsoft Entra ID feature should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra ID Enterprise Application with SAML-based SSO. Microsoft Entra ID Enterprise Application with SAML-based SSO is the correct feature because it allows you to register partner applications that support SAML 2.0 or OpenID Connect, enabling federated single sign-on using existing Microsoft Entra ID credentials. Additionally, you can customize the branding (logo, sign-in page text, etc.) for each enterprise application, meeting the requirement to customize the appearance of sign-in pages.

Answer

Microsoft Entra ID B2C

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Entra ID Conditional Access

Question 2

A company uses Microsoft Entra ID. They want to allow users to sign in to partner applications using their Microsoft Entra ID credentials. The partner applications support SAML 2.0 and OpenID Connect. They also need to customize the appearance of the sign-in pages. Which Microsoft Entra ID feature should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Event Hubs. Azure Event Hubs is the correct service because it provides a high-throughput, low-latency data ingestion platform that can receive streaming diagnostic data from Microsoft Entra ID. By configuring diagnostic settings in Entra ID to stream sign-in and audit logs to an Event Hubs namespace, you enable near real-time export to a third-party SIEM tool via the Event Hubs-compatible endpoint, typically using the AMQP or HTTPS protocol.

Answer

Azure Logic Apps

Answer

Azure Monitor

Answer

Azure Storage

Question 3

A company uses Microsoft Entra ID. They want to allow users to sign in to partner applications using their Microsoft Entra ID credentials. The partner applications support SAML 2.0 and OpenID Connect. They also need to customize the appearance of the sign-in pages. Which Microsoft Entra ID feature should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identity Protection with user risk policy. Identity Protection with a user risk policy is the correct feature because it allows automatic blocking of sign-ins when a user's account is flagged as high-risk by Microsoft's machine learning models. Additionally, the policy can be configured to require a secure password reset (self-service password reset) as a remediation action, directly meeting both requirements.

Answer

Conditional Access with location policy

Answer

Microsoft Entra ID MFA

Answer

Microsoft Entra ID Privileged Identity Management

Question 4

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically review and remove guest accounts that have not signed in for 90 days. They also need to generate reports for auditors. Which Microsoft Entra ID feature should they use?

Accepted Answer

Access Reviews. Access Reviews in Microsoft Entra ID allow administrators to create recurring reviews of guest users' access. By configuring a review with a 'days since last sign-in' condition (e.g., 90 days), Entra ID automatically flags and can remove guest accounts that have not authenticated within that period. The review process also generates detailed audit logs and reports suitable for auditor compliance, directly meeting the stated requirements.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Conditional Access

Question 5

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to integrate their on-premises Active Directory with Microsoft Entra ID to enable single sign-on (SSO) for cloud applications. Users should be able to use the same password for on-premises resources and cloud applications. The company has a large on-premises user base and wants to avoid additional infrastructure for federation. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Microsoft Entra ID Connect (Password Hash Synchronization). Password Hash Synchronization (PHS) is the correct choice because it synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID, enabling users to use the same password for both on-premises and cloud resources without requiring any additional federation infrastructure. This meets the requirement for SSO to cloud applications while avoiding the complexity and cost of deploying Active Directory Federation Services (AD FS) or other federation servers.

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Domain Services

Question 6

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically detect identity risks, such as users with leaked credentials or sign-ins from anonymous IP addresses, and generate alerts. They also want to automatically trigger a password reset for high-risk users. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to automatically detect identity risks such as leaked credentials and sign-ins from anonymous IP addresses. It generates alerts based on risk detections and can be configured to automatically trigger remediation actions like forcing a password reset for high-risk users through risk-based policies.

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Access Reviews

Question 7

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to grant temporary administrative roles to users for specific tasks. The process must require approval from a designated approver, and the access must automatically expire after a defined period. The company also needs audit logs of all role assignments and activations. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access, requiring approval from designated approvers and automatically expiring role assignments after a defined duration. PIM also generates detailed audit logs for all role activations and assignments, meeting the compliance and monitoring requirements.

Answer

Microsoft Entra ID Entitlement Management

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Conditional Access

Question 8

A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They want to enforce that users accessing sensitive cloud applications from outside the corporate network must use multi-factor authentication (MFA). Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to define policies that enforce MFA based on specific conditions, such as network location (outside corporate network) and cloud app sensitivity. By configuring a Conditional Access policy targeting 'All cloud apps' or specific sensitive apps with the condition 'Locations: All trusted/untrusted networks', you can require MFA for external access. This directly meets the requirement without needing additional licenses or features beyond Entra ID Premium P2.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Access Reviews

Question 9

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to automatically remove guest users who have not signed in for 60 days. Additionally, they must generate a report of all guest access for auditors. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Access Reviews. Access Reviews in Microsoft Entra ID allow administrators to create recurring reviews that automatically remove guest users who have not signed in within a specified period (e.g., 60 days) by configuring the 'Inactive users (in days)' setting. Additionally, Access Reviews generate a detailed report of all guest access decisions, which can be exported for auditors, meeting both requirements directly.

Answer

Entitlement Management

Answer

Identity Protection

Answer

Terms of Use

Question 10

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to allow users to sign in to multiple SaaS applications using their Microsoft Entra ID credentials without being prompted again for each application. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Single Sign-On (SSO). Single Sign-On (SSO) enables users to authenticate once with Microsoft Entra ID and then access multiple SaaS applications without being prompted again. This works by using standards like SAML 2.0 or OpenID Connect to issue a session token or cookie that is reused across applications, eliminating repeated credential prompts.

Answer

Multi-Factor Authentication (MFA)

Answer

Conditional Access

Answer

Identity Protection

Question 11

A company uses Microsoft Entra ID Premium P2. They need to automatically detect users with high-risk sign-ins (e.g., from anonymous IP addresses or leaked credentials) and require them to reset their password. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Identity Protection. Identity Protection is the correct feature because it is specifically designed to detect and remediate risky sign-ins, including those from anonymous IP addresses or leaked credentials. It uses machine learning to assign a risk level to each sign-in and user, and can automatically enforce password resets when high-risk events are detected, aligning with the requirement for automated detection and remediation.

Answer

Privileged Identity Management

Answer

Conditional Access

Answer

Access Reviews

Question 12

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to ensure that users who access sensitive cloud applications from untrusted networks (e.g., public Wi-Fi) are prompted for multi-factor authentication (MFA). Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID allow administrators to define conditions (e.g., network location, device state) under which access to cloud applications is granted. By configuring a policy that targets sensitive applications and requires MFA when the user's IP address is from an untrusted network (such as public Wi-Fi), the company can enforce MFA only when the risk condition is met, without affecting access from trusted corporate networks.

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra ID B2C

Question 13

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to automatically detect sign-ins from users with leaked credentials and prompt those users to reset their password during the next sign-in. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection includes a 'Leaked Credentials' detection capability that continuously monitors for credentials exposed in known data breaches. When a user's credentials are detected as leaked, Identity Protection can automatically trigger a password reset during the next sign-in, ensuring the compromised credentials are no longer usable.

Answer

Conditional Access

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra ID B2B

Question 14

A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They want to automatically block sign-ins from malicious IP addresses and require users to perform multi-factor authentication (MFA) when signing in from untrusted locations. Which Microsoft Entra ID feature should they use?

Accepted Answer

Identity Protection. Identity Protection (option B) is the correct feature because it uses machine learning and heuristics to detect risky sign-ins, such as those from malicious IP addresses or untrusted locations. It can automatically block sign-ins from known malicious IPs and, when combined with Conditional Access, require MFA for sign-ins from untrusted locations. This directly addresses the requirement to block malicious IPs and enforce MFA based on location risk.

Answer

Conditional Access policies

Answer

Privileged Identity Management

Answer

Access Reviews

Question 15

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to generate periodic reports of user sign-ins and audit activities for compliance. They want to store the logs for 1 year. Which Azure service should they use?

Accepted Answer

Azure Monitor Log Analytics workspace with Microsoft Entra ID diagnostic settings. Microsoft Entra ID sign-in and audit logs are retained for only 30 days by default. To store them for 1 year, you must route the logs via diagnostic settings to an Azure Monitor Log Analytics workspace, which allows configurable retention up to 2 years (or more with a commitment tier). This is the only native Azure service that supports long-term retention of Entra ID logs for compliance reporting.

Answer

Microsoft Entra ID sign-in logs and audit logs with retention set to 1 year in the Azure portal

Answer

Azure Storage account with lifecycle management

Answer

Azure Event Hubs for streaming