AZ-305 Design identity, governance, and monitoring solutions Practice Test 6 — 15 Questions

Question 1

A SaaS application must allow external partner users to sign in with their own organization credentials while the company controls application access. What should be used?

Accepted Answer

Microsoft Entra External ID/B2B collaboration with Conditional Access. Microsoft Entra External ID (formerly Azure AD B2B) enables external partner users to sign in using their own organization's credentials (their existing Azure AD or Microsoft account) while the company retains control over application access. By combining B2B collaboration with Conditional Access policies, the company can enforce MFA, device compliance, or location-based controls on guest users without managing their identities or passwords.

Answer

Create local cloud-only accounts for every partner user

Answer

Share one account per partner company

Answer

Use Azure DNS private zones

Question 2

An organization wants to enforce MFA only when sign-in risk is medium or high. Which Microsoft Entra capability should be used?

Accepted Answer

Conditional Access with Identity Protection risk signals. Conditional Access policies can integrate with Microsoft Entra Identity Protection risk signals to enforce MFA based on the calculated sign-in risk level (low, medium, high). When the risk is medium or high, the policy triggers MFA, meeting the requirement precisely. This is the only Microsoft Entra capability that directly uses risk-based conditional enforcement.

Answer

Azure RBAC deny assignments only

Answer

Access reviews only

Answer

Administrative units only

Question 3

Drag and drop the steps to implement Azure Site Recovery for a Hyper-V VM into the correct order.

Question 4

Drag and drop the steps to implement Azure AD Privileged Identity Management (PIM) for a role into the correct order.

Question 5

Drag and drop the steps to configure Azure Load Balancer for high availability of web servers into the correct order.

Question 6

Match each Azure service to its primary function.

Question 7

Match each Azure compute service to its characteristic.

Question 8

Match each Azure migration tool to its use case.

Question 9

You are designing a monitoring solution for a global e-commerce application hosted on Azure. The application experiences intermittent performance degradation that is difficult to reproduce. You need to ensure that you can capture detailed diagnostic data when the degradation occurs, without permanently storing large amounts of data. Which Azure feature should you use?

Accepted Answer

Implement an Azure Monitor Data Collection Rule with a schedule-based filter to capture detailed logs during degradation.. Option B is correct because Azure Monitor Data Collection Rules (DCRs) allow you to define a schedule-based filter that triggers detailed log collection only during specific conditions, such as when performance degradation is detected. This enables capturing granular diagnostic data exactly when needed without permanently storing large volumes of telemetry, aligning with the requirement to avoid persistent high storage costs.

Answer

Use Application Insights continuous export to send all telemetry to a storage account.

Answer

Configure a Log Analytics workspace to collect all performance counters and IIS logs.

Answer

Enable Azure Metrics for the application to monitor performance in real-time.

Question 10

Your company has a Microsoft Entra ID tenant with 10,000 users. You plan to grant external partners access to a specific SharePoint Online site using Microsoft Entra B2B collaboration. You need to ensure that partners can authenticate using their own corporate credentials. What should you configure?

Accepted Answer

Microsoft Entra B2B collaboration with external identities. Microsoft Entra B2B collaboration allows external partners to authenticate using their own corporate credentials (such as Azure AD, Microsoft account, or other identity providers) without requiring a separate password or local account. This is the correct solution because it directly supports the requirement for partners to use their own identity providers, enabling seamless access to the SharePoint Online site via guest user invitations.

Answer

Cross-tenant synchronization

Answer

Conditional Access policy for guest users

Answer

Microsoft Entra guest user accounts with password

Question 11

You are designing an identity governance solution for a multinational company. The company uses Microsoft Entra ID and has a requirement to automatically remove user access to critical SaaS applications when the user leaves the organization or changes roles. You need to ensure that the access removal is audited and can be reversed within 30 days if needed. What should you implement?

Accepted Answer

Microsoft Entra Access Reviews with automatic removal and a grace period. Microsoft Entra Access Reviews allow you to automatically remove user access to SaaS applications when a user leaves or changes roles, with a configurable grace period (up to 30 days) for reversal. This meets the audit and reversal requirements because Access Reviews provide a full audit trail of decisions and can automatically revoke access, while the grace period allows administrators to restore access within the specified timeframe.

Answer

Conditional Access policies to block access for inactive users

Answer

Azure Automation runbooks to delete user accounts upon termination

Answer

Microsoft Entra Privileged Identity Management (PIM) to require approval for access assignments

Question 12

Refer to the exhibit. You create this Azure Policy definition in a management group that contains all subscriptions. After assigning the policy, you notice that no audit events are generated when a new custom RBAC role is created. What is the most likely reason?

Accepted Answer

The 'Audit' effect with the specified details does not trigger an audit event when a custom role is created because the policy is not evaluating the correct condition.. Option C is correct because the policy uses 'Audit' effect but the details section incorrectly references all role definitions, which does not produce an audit log entry for custom role creation. The policy should use 'AuditIfNotExists' or 'Deny' effect to detect custom roles. Option A is wrong because custom policies can audit custom roles. Option B is wrong because the mode 'All' includes resource types like role definitions. Option D is wrong because custom RBAC roles are indeed a resource type that can be audited.

Answer

The policy should be assigned at the subscription level to audit custom role creation.

Answer

The policy definition is a custom policy, and custom policies cannot audit RBAC role definitions.

Answer

The policy mode is set to 'All', which does not include RBAC role definitions.

Question 13

Your organization is moving to a cloud-only identity model using Microsoft Entra ID. You need to ensure that users can reset their own passwords without help desk intervention. The solution must support multi-factor authentication and notify administrators of password resets. What should you implement?

Accepted Answer

Microsoft Entra Self-Service Password Reset (SSPR). Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords without help desk intervention. It supports multi-factor authentication (MFA) as a verification step before resetting, and can be configured to send notifications to administrators when a password reset occurs. This directly meets all stated requirements.

Answer

Microsoft Entra Connect Password Writeback

Answer

Conditional Access policies for password change

Answer

Microsoft Entra ID Protection

Question 14

Refer to the exhibit. You deploy this Azure Monitor scheduled query rule to alert when CPU usage exceeds 90% for sustained periods. However, alerts are not firing even when the condition is met. What is the most likely cause?

Accepted Answer

The threshold of 5 with 'Count' aggregation requires more than 5 data points above 90% in the window, which may not be happening.. Option D is correct because the alert rule uses a 'Count' aggregation with a threshold of 5, meaning the alert fires only when the number of data points exceeding 90% CPU within the evaluation window is greater than 5. If the sustained high CPU usage produces fewer than 5 such data points (e.g., due to a short burst or insufficient sampling), the condition is not met, and the alert will not fire. This is a common misconfiguration where the threshold value is set too high relative to the actual data point frequency.

Answer

The KQL query syntax is incorrect and returns no results.

Answer

The action group is not configured with a valid email address.

Answer

The evaluation frequency is too short compared to the window size.

Question 15

Your company uses Microsoft Entra ID to manage identities for 5,000 employees. You plan to implement Microsoft Entra ID Governance to automate the user provisioning lifecycle for a third-party SaaS application. The application supports SCIM 2.0. You need to ensure that user accounts are automatically created, updated, and disabled in the application based on changes in Entra ID. What should you do?

Accepted Answer

Configure automatic provisioning in Microsoft Entra ID using the SCIM endpoint. Option D is correct because Microsoft Entra ID's automatic provisioning feature natively supports SCIM 2.0 endpoints, enabling automated creation, update, and deactivation of user accounts in third-party SaaS applications based on changes in Entra ID. This eliminates the need for custom code and provides a managed, scalable solution for the user provisioning lifecycle.

Answer

Use Microsoft Graph API to write a custom provisioning solution

Answer

Configure Microsoft Entra B2B collaboration for the application

Answer

Publish the application using Microsoft Entra Application Proxy