AZ-305 Design identity, governance, and monitoring solutions Practice Test 4 — 15 Questions

Question 1

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to automate the process of granting users access to a specific application only during business hours and revoking it automatically. The access should be based on a request-approval workflow. Which Microsoft Entra ID feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Entitlement Management. Entitlement Management (D) is correct because it provides automated access lifecycle management through access packages, which can include time-bound assignments (e.g., business hours) and require approval workflows. This allows you to define policies that grant access to the application only during specified hours and automatically revoke it when the policy expires or conditions change, without manual intervention.

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Answer

Access Reviews

Question 2

A company uses Microsoft Entra ID. They need to monitor sign-in logs for anomalous activity (e.g., sign-ins from unfamiliar locations) and automatically take action such as requiring MFA or blocking sign-in. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Identity Protection. Identity Protection is the correct feature because it is specifically designed to detect anomalous sign-in activities, such as sign-ins from unfamiliar locations or anonymous IP addresses, and can automatically trigger risk-based remediation actions like requiring MFA or blocking sign-ins. It leverages machine learning models and real-time risk detections to assess sign-in risks and apply policies accordingly, directly meeting the requirement for monitoring and automated response.

Answer

Conditional Access

Answer

Access Reviews

Answer

Privileged Identity Management

Question 3

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to automate the process of granting users access to a specific application only during business hours and revoking it automatically. The access should be based on a request-approval workflow. Which Microsoft Entra ID feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra ID Application Proxy. Microsoft Entra ID Application Proxy is the correct choice because it enables secure remote access to on-premises web applications that do not support modern authentication. By publishing the internal application through Application Proxy, you can enforce device compliance policies (e.g., requiring a PIN and encryption) via Conditional Access policies applied to the Application Proxy service, even though the application itself uses legacy authentication.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Question 4

An enterprise wants just-in-time elevation for Azure administrators and periodic validation that privileged users still require access. Which two Microsoft Entra features should you recommend? (Choose 2.)

Accepted Answer

Microsoft Entra Privileged Identity Management.. Microsoft Entra access reviews satisfies the stem's second requirement: periodic validation that privileged users still need their access. Reviewers (or the users themselves) are prompted on a recurring schedule to attest to continued need, and access is automatically revoked if not approved. While access reviews does not provide the just-in-time elevation itself (that is PIM's role), it is the correct complementary feature for periodic recertification of standing or PIM-eligible privileged roles, which is why it is selected alongside Microsoft Entra PIM as the second correct answer.

Answer

Microsoft Entra Domain Services.

Answer

Azure Policy guest configuration.

Question 5

A company must prevent non-compliant devices from accessing Exchange Online and SharePoint Online. Which design should you recommend?

Accepted Answer

Conditional Access policy requiring a compliant device.. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) can enforce device compliance by integrating with Microsoft Intune. When a policy requires a compliant device, it checks the device's compliance status before granting access to Exchange Online and SharePoint Online, blocking non-compliant devices at the authentication layer. This is the correct design because it directly controls access to these cloud services based on device health.

Answer

Azure Firewall application rule.

Answer

Storage account network rule.

Answer

Resource lock on the Microsoft 365 tenant.

Question 6

A company plans to migrate on-premises applications to Azure. They require users to authenticate using their existing on-premises Active Directory credentials without syncing password hashes to the cloud. Which Microsoft Entra ID authentication method should they use?

Accepted Answer

Microsoft Entra ID Pass-through Authentication. Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud. A lightweight agent on-premises forwards authentication requests to the local domain controller, meeting the requirement to avoid password hash synchronization.

Answer

Microsoft Entra ID Password Hash Sync

Answer

Microsoft Entra ID Federation Services (AD FS)

Answer

Microsoft Entra ID Connect with Seamless SSO

Question 7

A multinational company uses Microsoft Entra ID and several Azure subscriptions. Security administrators need to review privileged role assignments every month and require justification for continued access. Which design should be recommended?

Accepted Answer

Microsoft Entra Privileged Identity Management with access reviews. Microsoft Entra Privileged Identity Management (PIM) with access reviews is the correct design because it provides time-bound, just-in-time privileged role assignments and requires users to periodically justify their continued access through automated access reviews. This directly meets the monthly review and justification requirement for privileged roles, as PIM integrates with Entra ID to enforce approval workflows and expiration policies.

Answer

Azure Monitor metric alerts

Answer

Management group locks

Answer

Azure Policy guest configuration

Question 8

A company wants workload deployments to access Azure resources without storing client secrets in CI/CD variables. The pipeline runs from GitHub Actions. Which identity design should be used?

Accepted Answer

Workload identity federation with Microsoft Entra ID. Workload identity federation with Microsoft Entra ID allows GitHub Actions to exchange an OpenID Connect (OIDC) token for an Azure access token, eliminating the need to store client secrets in CI/CD variables. This design uses short-lived tokens and federated identity credentials, aligning with the principle of zero-trust and secretless authentication.

Answer

A shared user account with MFA disabled

Answer

A storage account access key

Answer

A long-lived app registration client secret

Question 9

A SaaS application must allow external partner users to sign in with their own organization credentials while the company controls application access. What should be used?

Accepted Answer

Microsoft Entra External ID/B2B collaboration with Conditional Access. Microsoft Entra External ID (formerly Azure AD B2B) enables external partner users to sign in using their own organization's credentials (their existing Azure AD or Microsoft account) while the company retains control over application access. By combining B2B collaboration with Conditional Access policies, the company can enforce MFA, device compliance, or location-based controls on guest users without managing their identities or passwords.

Answer

Create local cloud-only accounts for every partner user

Answer

Share one account per partner company

Answer

Use Azure DNS private zones

Question 10

Drag and drop the steps to implement Azure Site Recovery for a Hyper-V VM into the correct order.

Accepted Answer

Create the vault, then ensure network connectivity, then install the provider and agent, then create and apply a replication policy, then enable replication.. First, create the vault. Then ensure network connectivity. Install the provider and agent. Create and apply a replication policy. Finally, enable replication.

Answer

Install the provider and agent, then create the vault, then ensure network connectivity, then create and apply a replication policy, then enable replication.

Answer

Create the vault, then ensure network connectivity, then create and apply a replication policy, then install the provider and agent, then enable replication.

Answer

Enable replication, then create the vault, then ensure network connectivity, then install the provider and agent, then create and apply a replication policy.

Question 11

Drag and drop the steps to implement Azure AD Privileged Identity Management (PIM) for a role into the correct order.

Accepted Answer

Select role, Configure settings, Assign eligible members, Set notifications, Test activation. Select role, configure settings, assign eligible members, set notifications, then test activation.

Answer

Select role, Assign eligible members, Configure settings, Set notifications, Test activation

Answer

Configure settings, Select role, Assign eligible members, Set notifications, Test activation

Answer

Select role, Configure settings, Set notifications, Assign eligible members, Test activation

Question 12

Drag and drop the steps to configure Azure Load Balancer for high availability of web servers into the correct order.

Accepted Answer

Step 1: Create backend pool, Step 2: Create health probe, Step 3: Create rule, Step 4: Associate public IP, Step 5: Test. The correct sequence for configuring an Azure Load Balancer for high availability of web servers is to first create the backend pool, then the health probe, then the load balancing rule, then associate a public IP address, and finally test the configuration. This order ensures all dependencies are met: the health probe monitors the backend pool, the rule uses both, and the public IP provides external access. Common mistakes include swapping steps or creating the rule before its dependencies.

Answer

Step 1: Create health probe, Step 2: Create backend pool, Step 3: Create rule, Step 4: Associate public IP, Step 5: Test

Answer

Step 1: Create rule, Step 2: Create backend pool, Step 3: Create health probe, Step 4: Associate public IP, Step 5: Test

Answer

Step 1: Associate public IP, Step 2: Create backend pool, Step 3: Create health probe, Step 4: Create rule, Step 5: Test

Question 13

Match each Azure service to its primary function.

Accepted Answer

Azure Virtual Network: Enables private connectivity between Azure resources.. Correct matches: Azure Virtual Network provides private connectivity; Azure Load Balancer distributes traffic. Common confusions mix layer-4 and layer-7 services, and regional vs. global routing.

Answer

Azure VPN Gateway: Provides application-layer load balancing and web application firewall.

Answer

Azure Application Gateway: Routes incoming traffic across global Azure regions based on routing methods.

Answer

Azure Traffic Manager: Connects on-premises networks to Azure via encrypted tunnels.

Question 14

Match each Azure compute service to its characteristic.

Accepted Answer

Virtual Machines: Provides full control over the operating system and allows custom software installation.. Azure compute services range from IaaS (Virtual Machines) to PaaS (App Service) to serverless (Azure Functions) and container orchestration (AKS). Distractors confuse definitions of serverless and container orchestration, or PaaS and managed Kubernetes.

Answer

Azure Functions: Managed container orchestration service for deploying and managing containerized applications.

Answer

Azure Kubernetes Service: Managed platform for building, deploying, and scaling web apps and APIs.

Question 15

Match each Azure migration tool to its use case.

Accepted Answer

Azure Migrate: Assess and migrate on-premises servers to Azure.. Azure Migrate is for server assessment/migration, Azure Site Recovery for disaster recovery, and Azure Database Migration Service for database migrations. Common confusions involve swapping these use cases.

Answer

Azure Migrate: Automate disaster recovery and failover.

Answer

Azure Site Recovery: Assess and migrate on-premises servers to Azure.

Answer

Azure Database Migration Service: Transfer large amounts of data via physical device.