AZ-305 Design identity, governance, and monitoring solutions Practice Test 8 — 15 Questions

Question 1

You are designing a monitoring solution for a critical application running on Azure Kubernetes Service (AKS). The application generates custom metrics that need to be queried in real-time for dashboards. You also need to retain logs for one year for compliance. Which combination of services should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Monitor Metrics and Azure Monitor Logs. Azure Monitor Metrics is the correct choice for real-time querying of custom metrics because it stores numeric time-series data with sub-minute granularity and supports near real-time alerting and dashboarding via Azure Dashboards or Grafana. Azure Monitor Logs (Log Analytics) is required for retaining logs for one year, as it offers configurable retention up to 730 days (2 years) and supports KQL queries for compliance and audit needs. Together, they provide a unified monitoring solution for AKS that meets both real-time metric querying and long-term log retention requirements.

Answer

Prometheus and Azure Monitor Logs

Answer

Azure Data Explorer and Azure Blob Storage

Answer

Application Insights and Azure Storage

Question 2

Your company plans to use Microsoft Sentinel for security information and event management (SIEM). You need to ingest security logs from multiple Azure resources and on-premises servers. Which data connector should you use for Windows servers on-premises?

Accepted Answer

Azure Monitor Agent. The Azure Monitor Agent (AMA) is the correct choice because it is the current, recommended data collection agent for Microsoft Sentinel, replacing the legacy Log Analytics agent. It supports collecting security logs from Windows servers on-premises via the Windows Security Events via AMA connector, which uses data collection rules (DCRs) for flexible, scalable log ingestion. AMA is optimized for Sentinel's SIEM requirements and provides better performance, security, and manageability than its predecessor.

Answer

Log Analytics agent

Answer

Microsoft Defender for Cloud agent

Answer

Azure Arc agent

Question 3

You are designing an identity solution for a large enterprise that uses Microsoft Entra ID. The company has a partner organization that needs access to a specific application. The partner uses their own identity provider (IdP). You need to enable seamless access without duplicating user accounts. What should you configure?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD B2B) is the correct solution because it allows the partner organization to access the specific application using their own identity provider (IdP) without requiring duplicate user accounts in your tenant. It leverages federation trust, enabling seamless single sign-on (SSO) by authenticating users against their home IdP and issuing a token for your application. This aligns with the requirement for a zero-trust, external identity scenario where user lifecycle is managed externally.

Answer

Federation with the partner's IdP

Answer

Passwordless authentication

Answer

Identity synchronization

Question 4

Your Azure subscription contains multiple virtual machines (VMs) that run a line-of-business application. You need to configure alerts when the CPU usage exceeds 90% for more than 5 minutes. Additionally, the alert must automatically trigger a runbook to scale out the application. Which Azure service should you use to create this alert?

Accepted Answer

Azure Monitor metric alert. Azure Monitor metric alerts can evaluate resource metrics like CPU usage at a specified frequency and trigger actions when a threshold (e.g., 90%) is breached for a given duration (e.g., 5 minutes). The alert can invoke an Automation runbook via an action group, enabling automatic scaling of the application. This is the correct service because it directly supports metric-based alerting with multi-condition evaluation and action group integration.

Answer

Azure Automation

Answer

Azure Logic Apps

Answer

Azure Autoscale

Question 5

Which TWO of the following are valid Azure Policy effects that can be used to enforce compliance?

Accepted Answer

DeployIfNotExists. Both Deny and DeployIfNotExists are valid Azure Policy effects that enforce compliance. Deny blocks creation or update of non-compliant resources, directly enforcing the policy. DeployIfNotExists evaluates resources after creation and deploys a template to remediate non-compliance, such as automatically installing agents. Modify is also a valid effect, but it is not one of the two selected for this question. AuditIfNotExists only audits without enforcement, and AutoRemediate is not a real effect.

Answer

AuditIfNotExists

Answer

Modify

Answer

AutoRemediate

Question 6

Which THREE of the following are required to collect Windows security events into Microsoft Sentinel?

Accepted Answer

Log Analytics workspace. A Log Analytics workspace is required because Microsoft Sentinel is built on top of it; all security events collected by Sentinel are stored in the workspace's tables, and Sentinel uses the workspace as its data repository for analytics, alerting, and investigation.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 7

Refer to the exhibit. You apply this Azure Policy to a subscription. What happens when a user tries to create a virtual machine?

Accepted Answer

The creation of the virtual machine is denied.. The Azure Policy in the exhibit uses the 'deny' effect, which explicitly blocks any operation that does not comply with the policy rule. When a user attempts to create a virtual machine, Azure Resource Manager evaluates the policy before provisioning the resource. If the VM creation request does not meet the conditions defined in the policy (e.g., requiring a specific tag or location), the request is denied and the VM is not created. This is why option C is correct.

Answer

The virtual machine is created, and an audit event is logged.

Answer

The virtual machine is created only if it has a specific tag.

Answer

The virtual machine is created only in a specific location.

Question 8

Refer to the exhibit. You create this Conditional Access policy in Microsoft Entra ID. What is the result?

Accepted Answer

All users are prompted for MFA when accessing any application from a browser or mobile app.. The exhibit shows a Conditional Access policy that applies to 'All users' and targets 'All cloud apps' with the grant control set to 'Require multi-factor authentication'. This configuration forces every user, including administrators and external users, to complete MFA when accessing any cloud application from any platform (browser or mobile app). Option B correctly states this universal MFA requirement.

Answer

Only administrators are prompted for MFA.

Answer

External users are prompted for MFA.

Answer

Access is blocked for all users.

Question 9

Refer to the exhibit. You run this Kusto query in Azure Monitor Logs. What does it return?

Accepted Answer

Computers that have not sent a heartbeat in the last 5 minutes.. The query uses the `Heartbeat` table and filters for heartbeats older than 5 minutes (`ago(5m)`). The `where` clause selects records where `TimeGenerated` is less than 5 minutes ago, meaning it finds heartbeats that were sent before that threshold. The `distinct Computer` then returns only computers whose most recent heartbeat is older than 5 minutes, i.e., computers that have not sent a heartbeat in the last 5 minutes. This is a common pattern for detecting unresponsive or offline machines.

Answer

The number of heartbeats per computer in the last hour.

Answer

Computers that sent a heartbeat in the last 5 minutes.

Answer

The average heartbeat frequency per computer.

Question 10

Your company is designing a governance strategy for Azure resources. The security team requires that all resource groups in the production subscription must have a specific tag (Environment=Production) applied automatically. Any resource group created without this tag must be reported within 24 hours. Which Azure policy should you implement?

Accepted Answer

Create a policy with effect 'modify' to add the tag using a managed identity.. The 'modify' effect automatically adds the required tag to resource groups during creation, ensuring the tag is applied automatically. Additionally, Azure Policy can report non-compliant resource groups through compliance evaluation, and if any resource group is created without the tag, it will be flagged as non-compliant until the tag is added. With a remediation task, the tag can be added automatically, and the compliance report will show the status within 24 hours. Option C ('deny') blocks creation but does not automatically apply the tag, and option B ('append') adds the tag but does not provide a built-in reporting mechanism. Option A ('audit') only reports non-compliance without applying the tag automatically.

Answer

Create a policy with effect 'audit' to report non-compliant resource groups.

Answer

Create a policy with effect 'append' to add the missing tag automatically.

Answer

Create a policy with effect 'deny' on the missing tag condition.

Question 11

You are designing a monitoring solution for a critical application running on Azure Kubernetes Service (AKS). The application generates custom metrics that need to be queried in real-time for dashboards. You also need to retain logs for one year for compliance. Which combination of services should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Metric alert. Metric alerts in Azure Monitor evaluate resource metrics (like CPU percentage) at regular intervals and trigger actions when a threshold is breached for a specified duration. Since the question involves a latency-sensitive application and a numeric threshold (CPU > 90% for 5 minutes), a metric alert is the correct choice because it provides near-real-time, low-latency evaluation directly from the VM's performance counters.

Answer

Service health alert

Answer

Log alert

Answer

Activity log alert

Question 12

Your company uses Microsoft Entra ID (formerly Azure AD) and requires that all external guest users must be automatically reviewed for access every 90 days. The review should be performed by the guest user's manager in the partner organization. However, the partner organization does not use Microsoft Entra ID. Which solution should you implement?

Accepted Answer

Configure Microsoft Entra ID access reviews to ask the guest user to self-attest their access every 90 days.. Microsoft Entra ID access reviews can be configured to require guest users to self-attest their access. This is the only viable solution when the guest user's organization does not use Microsoft Entra ID, as there is no external manager identity to assign the review to. The self-attestation process allows the guest user to confirm whether they still need access, and the review can be set to recur every 90 days as required.

Answer

Create a custom Azure Logic App to send email reminders and manually track access expiration.

Answer

Configure Microsoft Entra ID access reviews to include guest users and assign the review to the guest user's external manager.

Answer

Use Azure AD B2C to manage guest identities and set up a custom review process.

Question 13

Your organization is implementing a zero-trust security model. You need to ensure that all access to corporate resources from mobile devices is conditional based on device compliance, user risk, and location. Which Microsoft Entra ID feature should you use?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID are the correct choice because they allow you to enforce access controls based on conditions such as device compliance (via integration with Microsoft Intune), user risk (via integration with Identity Protection), and location (via IP ranges or named locations). This directly supports the zero-trust principle of 'never trust, always verify' by evaluating signals before granting access to corporate resources.

Answer

Identity Protection

Answer

Microsoft Intune

Answer

Microsoft Defender XDR

Question 14

You are designing a governance strategy for a multi-subscription Azure environment. Your compliance team requires that any resource group created in the production subscription must have a specific naming convention: it must start with 'prod-' and be followed by a three-letter department code and a two-digit number. Any resource group not following this convention should be automatically prevented from creation. Which Azure policy definition should you use?

Accepted Answer

Use a policy with 'pattern' constraint on the 'name' field.. Azure Policy's 'pattern' constraint uses regular expressions to enforce complex naming conventions. The requirement for resource groups to start with 'prod-', followed by a three-letter department code and a two-digit number, is a pattern that can be precisely defined with a regex like '^prod-[a-z]{3}\d{2}$'. The 'pattern' constraint is the only option that supports regex-based validation, making it suitable for this multi-part naming rule.

Answer

Use a policy with 'like' constraint on the 'name' field.

Answer

Use a policy with 'match' constraint on the 'name' field.

Answer

Use a policy with 'contains' constraint on the 'name' field.

Question 15

Your company has multiple Azure subscriptions. You need to ensure that all security-related logs from Azure resources are centralized in a single Log Analytics workspace for analysis. Which Azure service should you use to collect and route these logs?

Accepted Answer

Azure Policy. Azure Policy is correct because it can enforce the deployment of a diagnostic setting on all Azure resources, automatically routing security-related logs (such as Activity Logs, resource logs, and audit logs) to a single Log Analytics workspace. This ensures centralized collection and analysis without manual configuration per resource, meeting the requirement for a governance-driven approach.

Answer

Azure Monitor

Answer

Microsoft Sentinel

Answer

Azure Event Hubs