AZ-305 Design identity, governance, and monitoring solutions Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. You are analyzing a deployment of a Custom Script Extension on an Azure VM. The extension fails to run. What is the most likely cause?

Accepted Answer

The 'protectedSettings' property is misconfigured.. The Custom Script Extension on Azure VMs requires the `commandToExecute` parameter to be placed in the `protectedSettings` property when the script URL or command contains sensitive information (e.g., storage account keys). If `commandToExecute` is incorrectly placed in the `publicSettings` property instead, or if the `protectedSettings` JSON structure is malformed (e.g., missing the required `commandToExecute` key or using an incorrect casing), the extension will fail to run because it cannot parse the execution command. This is a common misconfiguration that causes the extension to report a failure status without executing the script.

Answer

The VM agent is not installed.

Answer

The VM has no outbound internet connectivity.

Answer

The extension type is incorrect.

Question 2

You have an Azure subscription that contains 100 virtual machines. You need to monitor the virtual machines for security vulnerabilities and receive recommendations. What should you use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides unified security management and advanced threat protection across hybrid cloud workloads. It continuously assesses your virtual machines for security vulnerabilities, misconfigurations, and missing updates, then delivers actionable recommendations and a secure score to prioritize remediation. This directly matches the requirement to monitor VMs for vulnerabilities and receive recommendations.

Answer

Azure Monitor

Answer

Microsoft Sentinel

Answer

Microsoft Defender XDR

Question 3

Your organization uses Microsoft Entra ID. You need to allow external users to sign in using their own identity providers (e.g., Google, Facebook) to access a custom application. What should you configure?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD External Identities) is the correct solution because it is specifically designed to allow external users to authenticate using their own social identity providers (e.g., Google, Facebook) via OAuth 2.0 and OpenID Connect protocols. This configuration enables a custom application to accept sign-ins from these external identities without requiring them to have a Microsoft Entra ID account, using a dedicated external tenant or identity experience.

Answer

Microsoft Entra Connect

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra ID (tenant)

Question 4

You need to design a solution to monitor the performance of an Azure SQL Database. You want to create a dashboard that shows the top 10 queries by CPU usage over the last hour. What should you use?

Accepted Answer

Azure SQL Analytics. Azure SQL Analytics is a dedicated monitoring solution for Azure SQL Database that provides built-in views and dashboards for top queries by CPU, duration, and other performance metrics. It leverages the Query Store and DMVs to surface the top 10 queries by CPU usage over the last hour without requiring custom queries or additional configuration.

Answer

Azure Monitor Workbooks

Answer

Power BI

Answer

Log Analytics

Question 5

Your organization has multiple Azure subscriptions. You need to create a central view of policy compliance across all subscriptions. What should you use?

Accepted Answer

Azure Policy compliance dashboard. The Azure Policy compliance dashboard provides a centralized view of policy compliance across all subscriptions in a management group or tenant. It aggregates compliance data from all assigned policies and initiatives, allowing you to filter by subscription, policy definition, or compliance state. This is the native tool designed specifically for cross-subscription policy compliance monitoring.

Answer

Azure Monitor

Answer

Azure Resource Graph

Answer

Azure Blueprints

Question 6

You have an Azure subscription that contains a virtual network named VNet1. You need to monitor all network security group (NSG) flow logs. Which three components must you enable? (Select THREE.)

Accepted Answer

Azure Network Watcher. Network security group flow logs must be explicitly enabled on the NSG to capture IP traffic data. Without enabling this feature, no flow log data is generated regardless of other components. The question asks which components must be enabled, and enabling NSG flow logs is the direct action that starts logging.

Answer

Log Analytics workspace

Answer

Traffic Analytics

Question 7

You need to ensure that only authorized users can access the Azure portal. What should you use?

Accepted Answer

Conditional Access policies. Conditional Access policies are the correct choice because they enforce access control decisions at the Azure AD authentication layer, allowing you to require specific conditions (e.g., MFA, compliant device, trusted IP) before a user can sign in to the Azure portal. This directly ensures that only authorized users—those meeting the defined conditions—can access the portal, regardless of their role assignments. Azure RBAC controls what actions a user can perform after authentication, not whether they can sign in at all.

Answer

Azure RBAC

Answer

Privileged Identity Management (PIM)

Answer

Azure AD Identity Protection

Question 8

Refer to the exhibit. You are deploying NSG flow logs. After deployment, you notice that no logs are being written to the storage account. What is the most likely cause?

Accepted Answer

Network Watcher is not enabled in the region.. NSG flow logs require Network Watcher to be enabled in the region where the NSG resides. If Network Watcher is not enabled, the flow logs cannot be written to the storage account because the logging pipeline depends on the Network Watcher agent to capture and forward flow data. Enabling Network Watcher in the region resolves this issue.

Answer

Retention policy is set to 0 days.

Answer

The storage account is in a different subscription.

Answer

The format version is incorrect.

Question 9

Your organization has a hybrid identity with Microsoft Entra ID and on-premises Active Directory. You need to allow users to reset their own passwords from the cloud. What should you configure?

Accepted Answer

Azure AD self-service password reset with password writeback. Azure AD self-service password reset (SSPR) with password writeback is the correct configuration because it allows users to reset their on-premises Active Directory passwords from the cloud. Password writeback ensures that the new password is written back to the on-premises AD, maintaining hybrid identity synchronization. Without writeback, cloud-only password resets would not update the on-premises directory, breaking the hybrid identity model.

Answer

Password hash synchronization only

Answer

Azure AD Connect with password hash sync

Answer

Pass-through authentication

Question 10

You need to monitor Azure resources and send alerts when the CPU usage of a virtual machine exceeds 90% for 5 minutes. Which two Azure services should you use? (Select TWO.)

Accepted Answer

Azure Monitor Action Groups. Azure Monitor is the core service for collecting and analyzing metrics and logs from Azure resources. It can be configured with metric alerts that trigger when CPU usage exceeds 90% for 5 minutes. Action Groups define the notification and response actions (e.g., email, SMS, webhook) that are executed when the alert fires, making them essential for sending alerts.

Answer

Log Analytics

Answer

Application Insights

Answer

Event Grid

Question 11

You need to assign permissions to an Azure resource group so that a user can create and manage virtual machines but cannot delete the resource group. What should you use?

Accepted Answer

Assign the Contributor role at the resource group level.. The Contributor role at the resource group level grants full management access to all resources within the resource group, including creating and managing virtual machines, but explicitly prevents the user from deleting the resource group itself. This meets the requirement because the Contributor role cannot perform management operations on the resource group scope, such as deletion, which is reserved for the Owner role.

Answer

Assign the Owner role at the resource group level.

Answer

Assign the Reader role at the resource group level.

Answer

Assign the User Access Administrator role at the resource group level.

Question 12

Your company uses Microsoft Entra ID for identity management. You need to ensure that users can access corporate resources without passwords while maintaining a high level of security. Which feature should you implement?

Accepted Answer

Passwordless authentication. Passwordless authentication (Option C) is correct because it allows users to access corporate resources without entering a password, using methods like Windows Hello for Business, FIDO2 security keys, or the Microsoft Authenticator app. This eliminates password-related risks (e.g., phishing, credential theft) while maintaining strong security through cryptographic key pairs or biometric verification, aligning with the requirement for both password-free access and high security.

Answer

Azure AD B2C

Answer

Conditional Access policies

Answer

Multifactor authentication (MFA)

Question 13

Your Azure environment includes multiple subscriptions that are managed by different teams. You need to ensure that all resources are compliant with your company's security policies, and any non-compliant resources must be automatically remediated or reported. Which solution should you implement?

Accepted Answer

Azure Policy with remediation tasks. Azure Policy with remediation tasks is the correct solution because it allows you to define and enforce security policies across multiple subscriptions, and automatically remediate non-compliant resources using managed identities and DeployIfNotExists or Modify policy effects. This ensures continuous compliance without manual intervention, meeting the requirement for both automatic remediation and reporting.

Answer

Azure Blueprints

Answer

Azure RBAC

Answer

Microsoft Defender for Cloud

Question 14

You need to monitor the performance and health of your Azure virtual machines, including custom metrics and logs. You also need to set up alerts based on specific thresholds. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct choice because it provides a comprehensive solution for collecting, analyzing, and acting on telemetry from Azure virtual machines, including custom metrics and logs. It integrates with the Azure Monitor Agent to gather performance counters and event logs, and supports metric alerts and log alerts based on specific thresholds, directly meeting all stated requirements.

Answer

Application Insights

Answer

Azure Service Health

Answer

Log Analytics

Question 15

Your organization uses Microsoft Entra ID and requires that all external users accessing resources must be approved by a designated reviewer. You need to automate the review process for external identities. What should you implement?

Accepted Answer

Microsoft Entra access reviews. Microsoft Entra access reviews allow you to automate the periodic review of external identities, ensuring that only approved users retain access. This feature directly supports the requirement for a designated reviewer to approve or deny external users, with automated reminders and results. It is the correct choice because it is purpose-built for governance of external identities in Entra ID.

Answer

Microsoft Purview

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access