AZ-305 Design identity, governance, and monitoring solutions Practice Test 7 — 15 Questions

Question 1

You are designing a monitoring solution for Azure SQL Database. The requirement is to track query performance metrics such as CPU usage, data IO, and wait statistics over time. You need to identify performance bottlenecks and provide historical data for analysis. Which Azure service should you use?

Accepted Answer

Query Performance Insight for Azure SQL Database. Query Performance Insight for Azure SQL Database is the correct choice because it provides built-in, intelligent analysis of top queries by CPU, data IO, and wait statistics over time, enabling you to identify performance bottlenecks and review historical data. It is specifically designed for Azure SQL Database and offers a customizable time range for trend analysis, directly meeting the requirement to track query performance metrics and analyze historical data.

Answer

Azure Monitor Metrics for Azure SQL Database

Answer

Azure SQL Analytics (preview) in Azure Monitor

Answer

Azure SQL Database Intelligent Insights

Question 2

Your organization has a hybrid identity infrastructure with Microsoft Entra ID and on-premises Active Directory. You plan to implement Microsoft Entra ID Protection to detect and respond to identity risks. You need to ensure that risky sign-ins from anonymous IP addresses are automatically blocked, while still allowing legitimate users to self-remediate. What should you configure?

Accepted Answer

Configure a Conditional Access policy to block sign-ins from anonymous IP addresses and enable user risk policy for self-remediation. Option C is correct because it combines a Conditional Access policy to block sign-ins from anonymous IP addresses with a user risk policy that allows legitimate users to self-remediate by performing a password change. This ensures that high-risk sign-ins are automatically blocked while users can still recover their accounts without administrative intervention.

Answer

Configure a sign-in risk policy in Microsoft Entra ID Protection to block access for high risk

Answer

Use the Identity Protection dashboard to manually review and block risky sign-ins

Answer

Configure a user risk policy to require password change for high risk users

Question 3

You are designing a governance strategy for Azure resources. Your organization has multiple departments, each with its own set of Azure subscriptions. You need to enforce consistent policies across all subscriptions, such as allowed resource locations and required tags, while allowing departments to manage their own resources within those constraints. Which Azure service should you use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it enforces organizational standards and compliance rules across all Azure resources, such as allowed locations and required tags, at scale. It applies policies to management groups, subscriptions, or resource groups, ensuring consistent governance while allowing departments to manage their own resources within those constraints. Unlike Azure Blueprints, which deploys a full environment template, Azure Policy focuses solely on rule enforcement and remediation.

Answer

Azure Blueprints

Answer

Azure Management Groups

Answer

Azure Role-Based Access Control (RBAC)

Question 4

Which TWO are benefits of using Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Automate the deprovisioning of user accounts when an employee leaves the organization. Option A is correct because Microsoft Entra ID Governance includes automated lifecycle workflows that can detect when an employee leaves the organization (e.g., via HR integration) and automatically remove or disable their user accounts, ensuring timely deprovisioning and reducing security risks. This automation is a core governance capability that enforces the principle of least privilege and helps maintain a clean identity lifecycle.

Answer

Enable just-in-time privileged access to Azure resources

Answer

Provide single sign-on to all SaaS applications

Answer

Provide VPN connectivity for remote users

Question 5

Which THREE should you consider when designing a monitoring solution for a critical application that requires high availability and low latency? (Choose three.)

Accepted Answer

Data volume and associated costs. Option B is correct because monitoring data volume directly impacts cost, especially in Azure Monitor where data ingestion and retention are billed per GB. For a critical application with high availability and low latency, you must balance the granularity of monitoring data against budget constraints to avoid unexpected costs that could compromise operational sustainability.

Answer

Dashboard visual appeal and color scheme

Answer

Custom metric creation for all application counters

Question 6

Which TWO are valid methods to authenticate to Azure from a PowerShell script that runs unattended? (Choose two.)

Accepted Answer

Service principal with a certificate. A service principal with a certificate is a valid unattended authentication method because the certificate can be securely stored (e.g., in Azure Key Vault or the local machine store) and used by the script without interactive login. The Azure PowerShell cmdlet `Connect-AzAccount -ServicePrincipal -CertificateThumbprint` or `-ApplicationId` with the certificate allows the script to authenticate using the certificate's private key, which is a non-interactive, secure approach.

Answer

User account with multi-factor authentication

Answer

User account with password and MFA

Answer

Managed identity for Azure resources

Question 7

Refer to the exhibit. You deploy this Azure Network Watcher connection monitor to test TCP connectivity on port 443 between two VMs. The test consistently shows 'Unreachable' status. Both VMs are running and have correct NSG rules allowing inbound port 443 from the source VM's IP. What is the most likely cause?

Accepted Answer

The source VM does not have the Network Watcher Agent installed.. The correct answer is A because Azure Network Watcher connection monitor relies on the Network Watcher Agent extension installed on both source and destination VMs to collect and report connectivity data. Without the agent on the source VM, the test cannot initiate the TCP probes, resulting in a persistent 'Unreachable' status regardless of NSG rules or VM health.

Answer

The destination VM's NSG is blocking the traffic despite the rule.

Answer

The destination VM's private IP address is incorrect.

Answer

A firewall on the destination VM is blocking TCP port 443.

Question 8

Your company plans to use Microsoft Sentinel as a SIEM solution. You need to ensure that security events from all Azure subscriptions are collected in a single workspace. What should you configure?

Accepted Answer

Enable Microsoft Sentinel on a single Log Analytics workspace and configure diagnostic settings for all subscriptions to send logs to that workspace. Option D is correct because Microsoft Sentinel requires a single Log Analytics workspace to act as the SIEM repository. By enabling Sentinel on that workspace and configuring diagnostic settings on all Azure subscriptions to stream their security logs (e.g., Activity logs, NSG flow logs, Windows Event logs) to that same workspace, you centralize all security events in one location. This ensures unified detection, investigation, and response across the entire enterprise without needing multiple Sentinel instances.

Answer

Create a Log Analytics workspace per subscription and use cross-workspace queries

Answer

Use Azure Policy to enforce Log Analytics workspace configuration across subscriptions

Answer

Deploy Microsoft Sentinel in each subscription and connect them via Azure Lighthouse

Question 9

A company uses Microsoft Entra ID for identity management. They want to ensure that users accessing sensitive data from unmanaged devices are prompted for multifactor authentication (MFA) and must accept a terms-of-use. Which policy should be configured?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow granular control over access based on conditions such as device state (managed vs. unmanaged). By configuring a policy that targets unmanaged devices, you can enforce MFA and require acceptance of a terms-of-use before granting access to sensitive data. This directly meets the requirement without needing separate policies for MFA and terms-of-use.

Answer

Terms-of-use policy

Answer

Identity Protection policy

Answer

Privileged Identity Management (PIM) policy

Question 10

Your organization is designing a monitoring solution for a critical application running on Azure VMs. You need to collect performance metrics and logs from the VMs and send them to a centralized Log Analytics workspace. You also need to visualize the data in near real-time. Which combination of services should you use?

Accepted Answer

Azure Monitor Agent and Azure Workbooks. Azure Monitor Agent is the current recommended agent for collecting performance metrics and logs from Azure VMs and sending them to a Log Analytics workspace. Azure Workbooks provide interactive, near real-time visualizations by querying the workspace data. This combination meets the requirements for centralized collection and visualization without unnecessary overhead.

Answer

Azure Diagnostics extension and VM Insights

Answer

Azure Monitor Agent and Azure Sentinel

Answer

Log Analytics Agent and Azure Dashboards

Question 11

A multinational company uses Microsoft Entra ID with a custom domain. They need to implement a governance strategy for Microsoft 365 groups, ensuring that group expiration policies are enforced and that group owners receive renewal notifications. What should you configure?

Accepted Answer

Microsoft Entra ID – Group settings (Expiration policy). Option B is correct because Microsoft Entra ID's Group settings include an expiration policy specifically designed to enforce lifecycle management for Microsoft 365 groups. This policy allows administrators to set a group expiration period (e.g., 180, 365 days) and automatically sends renewal notification emails to group owners before expiration, enabling them to renew the group if needed. This directly meets the requirement for enforcing group expiration and renewal notifications.

Answer

Microsoft Purview compliance portal – Data Lifecycle Management

Answer

Microsoft Intune – Device compliance policies

Answer

Microsoft Sentinel – Analytics rules

Question 12

Your company uses Azure Policy to enforce tagging standards. You need to ensure that any new resource group automatically inherits the 'CostCenter' tag from its subscription. Which Azure Policy effect should you use?

Accepted Answer

modify. The 'modify' effect is correct because it enables Azure Policy to add, update, or remove tags on resources and resource groups during creation or update. When combined with a 'deployIfNotExists' policy that targets resource groups, the 'modify' effect can automatically apply the 'CostCenter' tag from the subscription to any new resource group at creation time, ensuring inheritance without manual intervention.

Answer

deny

Answer

audit

Answer

append

Question 13

You are designing a monitoring solution for a hybrid environment with on-premises servers and Azure VMs. You need to collect security events and performance data centrally, and create custom alerts. The solution must use the same agent for both environments. Which agent should you deploy?

Accepted Answer

Azure Monitor Agent. Azure Monitor Agent (AMA) is the correct choice because it is the next-generation agent that replaces the legacy Log Analytics agent (MMA) and supports both Windows and Linux machines in hybrid and Azure environments. It collects security events and performance data into a single Log Analytics workspace and enables custom alert rules via data collection rules (DCRs), all with a single agent deployment.

Answer

Log Analytics agent (MMA)

Answer

Microsoft Dependency Agent

Answer

Azure Diagnostics extension

Question 14

Your organization uses Microsoft Entra ID with P2 licensing. You need to implement a strategy to automatically detect and remediate risky sign-ins without requiring user interaction for low-risk events. What should you configure?

Accepted Answer

Identity Protection sign-in risk policy set to allow access and log for low risk, and require MFA for medium and above. Option A is correct because the Identity Protection sign-in risk policy allows you to automatically respond to sign-in risk levels. By configuring it to 'allow access' and 'log' for low risk, you meet the requirement of no user interaction for low-risk events, while requiring MFA for medium and above ensures remediation for higher-risk sign-ins without manual intervention.

Answer

Conditional Access policy with session control requiring MFA for all sign-ins

Answer

Identity Protection user risk policy set to block high risk

Answer

Identity Protection sign-in risk policy set to allow access with MFA for medium and above

Question 15

Your company is deploying a new application on Azure Kubernetes Service (AKS). You need to monitor the health and performance of the cluster, including container logs, metrics, and request rates. Which Azure service should you enable?

Accepted Answer

Azure Monitor Container Insights. Azure Monitor Container Insights is the correct service because it is specifically designed to monitor the health and performance of Azure Kubernetes Service (AKS) clusters. It collects container logs, metrics (such as CPU/memory usage), and request rates from the cluster via a containerized Log Analytics agent, providing visibility into the performance of workloads running on AKS.

Answer

Azure Service Health

Answer

Azure Monitor for VMs

Answer

Azure Application Insights