AZ-305 Design identity, governance, and monitoring solutions Practice Test 6 — 15 Questions

Question 1

Your organization is designing a monitoring solution for a critical application running on Azure VMs. You need to collect performance metrics and logs from the VMs and send them to a centralized Log Analytics workspace. You also need to visualize the data in near real-time. Which combination of services should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Monitor Agent and Azure Workbooks. Azure Monitor Agent is the current recommended agent for collecting performance metrics and logs from Azure VMs and sending them to a Log Analytics workspace. Azure Workbooks provide interactive, near real-time visualizations by querying the workspace data. This combination meets the requirements for centralized collection and visualization without unnecessary overhead.

Answer

Azure Diagnostics extension and VM Insights

Answer

Azure Monitor Agent and Azure Sentinel

Answer

Log Analytics Agent and Azure Dashboards

Question 2

A multinational company uses Microsoft Entra ID with a custom domain. They need to implement a governance strategy for Microsoft 365 groups, ensuring that group expiration policies are enforced and that group owners receive renewal notifications. What should you configure?

Accepted Answer

Microsoft Entra ID – Group settings (Expiration policy). Microsoft Entra ID's Group settings include an expiration policy specifically designed to enforce lifecycle management for Microsoft 365 groups. This policy allows administrators to set a group expiration period (e.g., 180, 365 days) and automatically sends renewal notification emails to group owners before expiration, enabling them to renew the group if needed. This directly meets the requirement for enforcing group expiration and renewal notifications.

Answer

Microsoft Purview compliance portal – Data Lifecycle Management

Answer

Microsoft Intune – Device compliance policies

Answer

Microsoft Sentinel – Analytics rules

Question 3

Your company uses Azure Policy to enforce tagging standards. You need to ensure that any new resource group automatically inherits the 'CostCenter' tag from its subscription. Which Azure Policy effect should you use?

Accepted Answer

modify. The 'modify' effect is correct because it enables Azure Policy to add, update, or remove tags on resources and resource groups during creation or update. When combined with a 'deployIfNotExists' policy that targets resource groups, the 'modify' effect can automatically apply the 'CostCenter' tag from the subscription to any new resource group at creation time, ensuring inheritance without manual intervention.

Answer

deny

Answer

audit

Answer

append

Question 4

You are designing a monitoring solution for a hybrid environment with on-premises servers and Azure VMs. You need to collect security events and performance data centrally, and create custom alerts. The solution must use the same agent for both environments. Which agent should you deploy?

Accepted Answer

Azure Monitor Agent. Azure Monitor Agent (AMA) is the correct choice because it is the next-generation agent that replaces the legacy Log Analytics agent (MMA) and supports both Windows and Linux machines in hybrid and Azure environments. It collects security events and performance data into a single Log Analytics workspace and enables custom alert rules via data collection rules (DCRs), all with a single agent deployment.

Answer

Log Analytics agent (MMA)

Answer

Microsoft Dependency Agent

Answer

Azure Diagnostics extension

Question 5

Your organization uses Microsoft Entra ID with P2 licensing. You need to implement a strategy to automatically detect and remediate risky sign-ins without requiring user interaction for low-risk events. What should you configure?

Accepted Answer

Identity Protection sign-in risk policy set to allow access and log for low risk, and require MFA for medium and above. The Identity Protection sign-in risk policy allows you to automatically respond to sign-in risk levels. By configuring it to 'allow access' and 'log' for low risk, you meet the requirement of no user interaction for low-risk events, while requiring MFA for medium and above ensures remediation for higher-risk sign-ins without manual intervention.

Answer

Conditional Access policy with session control requiring MFA for all sign-ins

Answer

Identity Protection user risk policy set to block high risk

Answer

Identity Protection sign-in risk policy set to allow access with MFA for medium and above

Question 6

A company uses Microsoft Entra ID to manage identities for employees and partners. They need to allow partners to self-service reset their passwords using a mobile app notification. Which feature should you enable?

Accepted Answer

Microsoft Entra ID Self-Service Password Reset (SSPR). Microsoft Entra ID Self-Service Password Reset (SSPR) is the correct feature because it allows users, including partners configured as external users in the tenant, to reset their own passwords without administrator intervention. SSPR supports multiple authentication methods, including mobile app notification via the Microsoft Authenticator app, which satisfies the requirement for a mobile app notification-based reset. This feature is specifically designed for password reset scenarios and can be scoped to include guest users when properly configured.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Intune

Answer

Microsoft Entra ID Privileged Identity Management

Question 7

Your company has multiple Azure subscriptions managed by a management group. You need to enforce that all resources are deployed in the West US region only. Additionally, you must allow a specific resource group in the production subscription to be deployed in East US. What should you configure?

Accepted Answer

Assign a policy at the management group level that denies all locations except West US, and create a policy exemption for the specific resource group.. Azure Policy can be assigned at the management group level with a deny effect to restrict locations. To allow exceptions, you can create an exclusion by specifying the resource group as an exemption or by using a policy assignment at a lower scope with a different effect. The best practice is to use policy exemptions for specific RGs.

Answer

Assign a policy at the management group level that denies all locations except West US, and assign a separate policy at the subscription level that allows East US.

Answer

Assign a policy at each subscription level allowing only West US, and grant the resource group owner role to bypass.

Answer

Use Azure Blueprints to assign a policy at the management group and then edit the blueprint for the exception.

Question 8

Which TWO actions should you take to design a monitoring solution for a multi-tier application running on Azure VMs? (Select TWO.)

Accepted Answer

Configure Azure Monitor Agent to collect metrics and logs from each tier. Azure Monitor Agent is the modern, unified agent that collects metrics and logs from Azure VMs and sends them to Azure Monitor, Log Analytics workspaces, and other destinations. For a multi-tier application, collecting data from each tier is essential for end-to-end monitoring. Option D is correct because Application Insights provides application performance monitoring (APM) by instrumenting the application code itself, capturing telemetry like request rates, dependency calls, and exceptions, which is critical for understanding the behavior of a multi-tier application.

Answer

Deploy VM Insights on each VM

Answer

Create a Log Analytics workspace and connect all VMs

Answer

Enable Azure Monitor for VMs on all VMs

Question 9

Which THREE capabilities are provided by Microsoft Entra ID Identity Governance? (Select THREE.)

Accepted Answer

Entitlement management. Microsoft Entra ID Identity Governance is a suite of capabilities designed to help organizations manage and govern access to resources. Entitlement management (A) enables the creation of access packages to automate access requests, approvals, and assignments. Access reviews (B) allow periodic recertification of group memberships and application access to ensure only the right users have access. Privileged Identity Management (C) provides just-in-time privileged access and role activation workflows for Azure AD roles and Azure resources, directly supporting governance of elevated access.

Answer

Conditional Access

Answer

Identity Protection

Question 10

Which TWO are valid methods to authenticate users in a Microsoft Entra ID hybrid identity solution? (Select TWO.)

Accepted Answer

Password hash synchronization. Password hash synchronization (B), pass-through authentication (D), and federation with Active Directory Federation Services (AD FS) (C) are all valid authentication methods for Microsoft Entra ID hybrid identity solutions. PHS synchronizes password hashes to the cloud for authentication, PTA validates passwords on-premises via agents, and federation redirects authentication to an on-premises AD FS server. Cloud-only authentication (A) is not a hybrid method, and Seamless Single Sign-On (E) is a feature that works on top of PHS or PTA, not an authentication method itself.

Answer

Cloud-only authentication

Answer

Federation with Active Directory Federation Services (ADFS)

Answer

Seamless Single Sign-On

Question 11

Refer to the exhibit. You have an Azure Policy definition as shown. The policy is assigned at the subscription scope. What is the result when a user tries to create a VM with SKU Standard_D8s_v3?

Accepted Answer

The VM creation is denied.. The Azure Policy definition shown uses a 'Deny' effect for VM SKUs that do not match the allowed list. Since Standard_D8s_v3 is not in the allowed list (which includes Standard_D2s_v3, Standard_D4s_v3, and Standard_D8s_v3), the policy denies the VM creation. The 'Deny' effect prevents the resource from being created and logs a denial event in the activity log.

Answer

The VM is created successfully.

Answer

The VM is created but flagged as non-compliant.

Answer

The VM SKU is automatically changed to Standard_D4s_v3.

Question 12

Refer to the exhibit. You run the KQL query in Azure Monitor Log Analytics. Which user accounts should you investigate first?

Accepted Answer

Users with more than 5 medium-risk sign-ins in the last day.. The KQL query filters for sign-ins where RiskLevelDuringSignIn equals 'medium' and then summarizes by UserPrincipalName, counting occurrences. Users with more than 5 medium-risk sign-ins in the last day indicate a pattern of suspicious activity that warrants immediate investigation, as medium-risk sign-ins often correspond to atypical travel, anonymous IPs, or unfamiliar properties, but the query specifically targets the count threshold as the trigger for escalation.

Answer

Users with the highest number of sign-in attempts.

Answer

Users who had sign-ins from anonymous IP addresses.

Answer

Users who have unfamiliar features in their sign-ins.

Question 13

Refer to the exhibit. You are creating a role assignment in Azure. The role definition ID is for the Contributor role. What is the effect of this assignment?

Accepted Answer

The principal can manage all resources in resource group RG1.. The Contributor role in Azure provides full management access to all resources within the assigned scope, but it cannot grant access to other users (role assignments). Since the scope is resource group RG1, the principal can manage all resources in that resource group, including creating, deleting, and modifying them, but cannot manage access to the resource group itself.

Answer

The principal can read all resources in resource group RG1.

Answer

The principal can manage all resources in the subscription.

Answer

The principal can manage access to resource group RG1.

Question 14

You are designing a monitoring solution for a critical application that runs on Azure Virtual Machines. The application generates custom performance counters. You need to alert when the custom counter exceeds a threshold and trigger an Azure Automation runbook to remediate. Which two Azure services should you combine? (Select TWO.)

Accepted Answer

Azure Monitor. Azure Monitor is the correct choice because it collects and analyzes custom performance counters from Azure VMs, enabling metric-based alert rules. When a threshold is exceeded, Azure Monitor can trigger an action group that invokes an Azure Automation runbook, providing automated remediation. This combination directly addresses the requirement to alert on custom counters and execute a runbook in response.

Answer

Azure Event Grid

Answer

Log Analytics

Question 15

Your company has a Azure subscription with multiple resource groups. You need to ensure that all resources are tagged with a 'CostCenter' tag. What should you use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it enforces organizational standards and compliance by evaluating resources for non-compliance with defined rules, such as requiring a specific tag. You can create a policy that audits or denies resources missing the 'CostCenter' tag, ensuring all resources are tagged automatically or during deployment.

Answer

Azure Blueprints

Answer

Management Groups

Answer

Azure RBAC