AZ-305 Design identity, governance, and monitoring solutions Practice Test 5 — 15 Questions

Question 1

You are designing a monitoring solution for a global e-commerce application hosted on Azure. The application experiences intermittent performance degradation that is difficult to reproduce. You need to ensure that you can capture detailed diagnostic data when the degradation occurs, without permanently storing large amounts of data. Which Azure feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement an Azure Monitor Data Collection Rule with a schedule-based filter to capture detailed logs during degradation.. Azure Monitor Data Collection Rules (DCRs) allow you to define a schedule-based filter that triggers detailed log collection only during specific conditions, such as when performance degradation is detected. This enables capturing granular diagnostic data exactly when needed without permanently storing large volumes of telemetry, aligning with the requirement to avoid persistent high storage costs.

Answer

Use Application Insights continuous export to send all telemetry to a storage account.

Answer

Configure a Log Analytics workspace to collect all performance counters and IIS logs.

Answer

Enable Azure Metrics for the application to monitor performance in real-time.

Question 2

Your company has a Microsoft Entra ID tenant with 10,000 users. You plan to grant external partners access to a specific SharePoint Online site using Microsoft Entra B2B collaboration. You need to ensure that partners can authenticate using their own corporate credentials. What should you configure?

Accepted Answer

Microsoft Entra B2B collaboration with external identities. Microsoft Entra B2B collaboration allows external partners to authenticate using their own corporate credentials (such as Azure AD, Microsoft account, or other identity providers) without requiring a separate password or local account. This is the correct solution because it directly supports the requirement for partners to use their own identity providers, enabling seamless access to the SharePoint Online site via guest user invitations.

Answer

Cross-tenant synchronization

Answer

Conditional Access policy for guest users

Answer

Microsoft Entra guest user accounts with password

Question 3

You are designing an identity governance solution for a multinational company. The company uses Microsoft Entra ID and has a requirement to automatically remove user access to critical SaaS applications when the user leaves the organization or changes roles. You need to ensure that the access removal is audited and can be reversed within 30 days if needed. What should you implement?

Accepted Answer

Microsoft Entra Access Reviews with automatic removal and a grace period. Microsoft Entra Access Reviews allow you to automatically remove user access to SaaS applications when a user leaves or changes roles, with a configurable grace period (up to 30 days) for reversal. This meets the audit and reversal requirements because Access Reviews provide a full audit trail of decisions and can automatically revoke access, while the grace period allows administrators to restore access within the specified timeframe.

Answer

Conditional Access policies to block access for inactive users

Answer

Azure Automation runbooks to delete user accounts upon termination

Answer

Microsoft Entra Privileged Identity Management (PIM) to require approval for access assignments

Question 4

Refer to the exhibit. You create this Azure Policy definition in a management group that contains all subscriptions. After assigning the policy, you notice that no audit events are generated when a new custom RBAC role is created. What is the most likely reason?

Accepted Answer

The 'Audit' effect with the specified details does not trigger an audit event when a custom role is created because the policy is not evaluating the correct condition.. The Azure Policy definition shown in the exhibit uses the 'AuditIfNotExists' effect, which requires a condition that evaluates whether a specific resource (e.g., a diagnostic setting) exists. However, the creation of a custom RBAC role is a resource type ('Microsoft.Authorization/roleDefinitions') that is not covered by the 'AuditIfNotExists' effect in the way the policy is written. The policy is likely missing the correct condition or resource type filter, so no audit event is generated when a custom role is created.

Answer

The policy should be assigned at the subscription level to audit custom role creation.

Answer

The policy definition is a custom policy, and custom policies cannot audit RBAC role definitions.

Answer

The policy mode is set to 'All', which does not include RBAC role definitions.

Question 5

Your organization is moving to a cloud-only identity model using Microsoft Entra ID. You need to ensure that users can reset their own passwords without help desk intervention. The solution must support multi-factor authentication and notify administrators of password resets. What should you implement?

Accepted Answer

Microsoft Entra Self-Service Password Reset (SSPR). Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords without help desk intervention. It supports multi-factor authentication (MFA) as a verification step before resetting, and can be configured to send notifications to administrators when a password reset occurs. This directly meets all stated requirements.

Answer

Microsoft Entra Connect Password Writeback

Answer

Conditional Access policies for password change

Answer

Microsoft Entra ID Protection

Question 6

Refer to the exhibit. You deploy this Azure Monitor scheduled query rule to alert when CPU usage exceeds 90% for sustained periods. However, alerts are not firing even when the condition is met. What is the most likely cause?

Accepted Answer

The threshold of 5 with 'Count' aggregation requires more than 5 data points above 90% in the window, which may not be happening.. The alert rule uses a 'Count' aggregation with a threshold of 5, meaning the alert fires only when the number of data points exceeding 90% CPU within the evaluation window is greater than 5. If the sustained high CPU usage produces fewer than 5 such data points (e.g., due to a short burst or insufficient sampling), the condition is not met, and the alert will not fire. This is a common misconfiguration where the threshold value is set too high relative to the actual data point frequency.

Answer

The KQL query syntax is incorrect and returns no results.

Answer

The action group is not configured with a valid email address.

Answer

The evaluation frequency is too short compared to the window size.

Question 7

Your company uses Microsoft Entra ID to manage identities for 5,000 employees. You plan to implement Microsoft Entra ID Governance to automate the user provisioning lifecycle for a third-party SaaS application. The application supports SCIM 2.0. You need to ensure that user accounts are automatically created, updated, and disabled in the application based on changes in Entra ID. What should you do?

Accepted Answer

Configure automatic provisioning in Microsoft Entra ID using the SCIM endpoint. Microsoft Entra ID's automatic provisioning feature natively supports SCIM 2.0 endpoints, enabling automated creation, update, and deactivation of user accounts in third-party SaaS applications based on changes in Entra ID. This eliminates the need for custom code and provides a managed, scalable solution for the user provisioning lifecycle.

Answer

Use Microsoft Graph API to write a custom provisioning solution

Answer

Configure Microsoft Entra B2B collaboration for the application

Answer

Publish the application using Microsoft Entra Application Proxy

Question 8

You are designing a monitoring solution for a global e-commerce application hosted on Azure. The application experiences intermittent performance degradation that is difficult to reproduce. You need to ensure that you can capture detailed diagnostic data when the degradation occurs, without permanently storing large amounts of data. Which Azure feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Query Performance Insight for Azure SQL Database. Query Performance Insight for Azure SQL Database is the correct choice because it provides built-in, intelligent analysis of top queries by CPU, data IO, and wait statistics over time, enabling you to identify performance bottlenecks and review historical data. It is specifically designed for Azure SQL Database and offers a customizable time range for trend analysis, directly meeting the requirement to track query performance metrics and analyze historical data.

Answer

Azure Monitor Metrics for Azure SQL Database

Answer

Azure SQL Analytics (preview) in Azure Monitor

Answer

Azure SQL Database Intelligent Insights

Question 9

Your organization has a hybrid identity infrastructure with Microsoft Entra ID and on-premises Active Directory. You plan to implement Microsoft Entra ID Protection to detect and respond to identity risks. You need to ensure that risky sign-ins from anonymous IP addresses are automatically blocked, while still allowing legitimate users to self-remediate. What should you configure?

Accepted Answer

Configure a Conditional Access policy to block sign-ins from anonymous IP addresses and enable user risk policy for self-remediation. It combines a Conditional Access policy to block sign-ins from anonymous IP addresses with a user risk policy that allows legitimate users to self-remediate by performing a password change. This ensures that high-risk sign-ins are automatically blocked while users can still recover their accounts without administrative intervention.

Answer

Configure a sign-in risk policy in Microsoft Entra ID Protection to block access for high risk

Answer

Use the Identity Protection dashboard to manually review and block risky sign-ins

Answer

Configure a user risk policy to require password change for high risk users

Question 10

You are designing a governance strategy for Azure resources. Your organization has multiple departments, each with its own set of Azure subscriptions. You need to enforce consistent policies across all subscriptions, such as allowed resource locations and required tags, while allowing departments to manage their own resources within those constraints. Which Azure service should you use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it enforces organizational standards and compliance rules across all Azure resources, such as allowed locations and required tags, at scale. It applies policies to management groups, subscriptions, or resource groups, ensuring consistent governance while allowing departments to manage their own resources within those constraints. Unlike Azure Blueprints, which deploys a full environment template, Azure Policy focuses solely on rule enforcement and remediation.

Answer

Azure Blueprints

Answer

Azure Management Groups

Answer

Azure Role-Based Access Control (RBAC)

Question 11

Which TWO are benefits of using Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Automate the deprovisioning of user accounts when an employee leaves the organization. Option C explanation should be corrected: Just-in-time privileged access via PIM is in fact one of the four core components of Microsoft Entra ID Governance (alongside Lifecycle Workflows, Entitlement Management, and Access Reviews), so this option describes a genuine governance benefit rather than a separate PIM-only capability.

Answer

Enable just-in-time privileged access to Azure resources

Answer

Provide single sign-on to all SaaS applications

Answer

Provide VPN connectivity for remote users

Question 12

Which THREE should you consider when designing a monitoring solution for a critical application that requires high availability and low latency? (Choose three.)

Accepted Answer

Data volume and associated costs. Monitoring data volume directly impacts cost, especially in Azure Monitor where data ingestion and retention are billed per GB. For a critical application with high availability and low latency, you must balance the granularity of monitoring data against budget constraints to avoid unexpected costs that could compromise operational sustainability.

Answer

Dashboard visual appeal and color scheme

Answer

Custom metric creation for all application counters

Question 13

Which TWO are valid methods to authenticate to Azure from a PowerShell script that runs unattended? (Choose two.)

Accepted Answer

Service principal with a certificate. A service principal with a certificate is a valid unattended authentication method because the certificate can be securely stored (e.g., in Azure Key Vault or the local machine store) and used by the script without interactive login. The Azure PowerShell cmdlet `Connect-AzAccount -ServicePrincipal -CertificateThumbprint` or `-ApplicationId` with the certificate allows the script to authenticate using the certificate's private key, which is a non-interactive, secure approach.

Answer

User account with multi-factor authentication

Answer

User account with password and MFA

Answer

Managed identity for Azure resources

Question 14

Your company plans to use Microsoft Sentinel as a SIEM solution. You need to ensure that security events from all Azure subscriptions are collected in a single workspace. What should you configure?

Accepted Answer

Enable Microsoft Sentinel on a single Log Analytics workspace and configure diagnostic settings for all subscriptions to send logs to that workspace. Microsoft Sentinel requires a single Log Analytics workspace to act as the SIEM repository. By enabling Sentinel on that workspace and configuring diagnostic settings on all Azure subscriptions to stream their security logs (e.g., Activity logs, NSG flow logs, Windows Event logs) to that same workspace, you centralize all security events in one location. This ensures unified detection, investigation, and response across the entire enterprise without needing multiple Sentinel instances.

Answer

Create a Log Analytics workspace per subscription and use cross-workspace queries

Answer

Use Azure Policy to enforce Log Analytics workspace configuration across subscriptions

Answer

Deploy Microsoft Sentinel in each subscription and connect them via Azure Lighthouse

Question 15

A company uses Microsoft Entra ID for identity management. They want to ensure that users accessing sensitive data from unmanaged devices are prompted for multifactor authentication (MFA) and must accept a terms-of-use. Which policy should be configured?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow granular control over access based on conditions such as device state (managed vs. unmanaged). By configuring a policy that targets unmanaged devices, you can enforce MFA and require acceptance of a terms-of-use before granting access to sensitive data. This directly meets the requirement without needing separate policies for MFA and terms-of-use.

Answer

Terms-of-use policy

Answer

Identity Protection policy

Answer

Privileged Identity Management (PIM) policy