AZ-305 Design identity, governance, and monitoring solutions Practice Test 9 — 15 Questions

Question 1

You need to design a solution to monitor the performance of an Azure SQL Database. You want to create a dashboard that shows the top 10 queries by CPU usage over the last hour. What should you use?

Accepted Answer

Azure SQL Analytics. Azure SQL Analytics is a dedicated monitoring solution for Azure SQL Database that provides built-in views and dashboards for top queries by CPU, duration, and other performance metrics. It leverages the Query Store and DMVs to surface the top 10 queries by CPU usage over the last hour without requiring custom queries or additional configuration.

Answer

Azure Monitor Workbooks

Answer

Power BI

Answer

Log Analytics

Question 2

Your organization has multiple Azure subscriptions. You need to create a central view of policy compliance across all subscriptions. What should you use?

Accepted Answer

Azure Policy compliance dashboard. Option B is correct because Azure Policy compliance dashboard shows compliance across subscriptions. Option A is wrong because Azure Monitor is for telemetry. Option C is wrong because Azure Resource Graph is for querying resources. Option D is wrong because Azure Blueprints is for deploying environments.

Answer

Azure Monitor

Answer

Azure Resource Graph

Answer

Azure Blueprints

Question 3

You have an Azure subscription that contains a virtual network named VNet1. You need to monitor all network security group (NSG) flow logs. Which three components must you enable? (Select THREE.)

Accepted Answer

Network security group flow logs. Network security group flow logs must be explicitly enabled on the NSG to capture IP traffic data. Without enabling this feature, no flow log data is generated regardless of other components. The question asks which components must be enabled, and enabling NSG flow logs is the direct action that starts logging.

Answer

Azure Network Watcher

Answer

Log Analytics workspace

Question 4

You need to ensure that only authorized users can access the Azure portal. What should you use?

Accepted Answer

Conditional Access policies. Conditional Access policies are the correct choice because they enforce access control decisions at the Azure AD authentication layer, allowing you to require specific conditions (e.g., MFA, compliant device, trusted IP) before a user can sign in to the Azure portal. This directly ensures that only authorized users—those meeting the defined conditions—can access the portal, regardless of their role assignments. Azure RBAC controls what actions a user can perform after authentication, not whether they can sign in at all.

Answer

Azure RBAC

Answer

Privileged Identity Management (PIM)

Answer

Azure AD Identity Protection

Question 5

Refer to the exhibit. You are deploying NSG flow logs. After deployment, you notice that no logs are being written to the storage account. What is the most likely cause?

Accepted Answer

Network Watcher is not enabled in the region.. NSG flow logs require Network Watcher to be enabled in the region where the NSG resides. If Network Watcher is not enabled, the flow logs cannot be written to the storage account because the logging pipeline depends on the Network Watcher agent to capture and forward flow data. Enabling Network Watcher in the region resolves this issue.

Answer

Retention policy is set to 0 days.

Answer

The storage account is in a different subscription.

Answer

The format version is incorrect.

Question 6

Your organization has a hybrid identity with Microsoft Entra ID and on-premises Active Directory. You need to allow users to reset their own passwords from the cloud. What should you configure?

Accepted Answer

Azure AD self-service password reset with password writeback. Azure AD self-service password reset (SSPR) with password writeback is the correct configuration because it allows users to reset their on-premises Active Directory passwords from the cloud. Password writeback ensures that the new password is written back to the on-premises AD, maintaining hybrid identity synchronization. Without writeback, cloud-only password resets would not update the on-premises directory, breaking the hybrid identity model.

Answer

Password hash synchronization only

Answer

Azure AD Connect with password hash sync

Answer

Pass-through authentication

Question 7

You need to monitor Azure resources and send alerts when the CPU usage of a virtual machine exceeds 90% for 5 minutes. Which two Azure services should you use? (Select TWO.)

Accepted Answer

Azure Monitor Action Groups. Azure Monitor is the core service for collecting and analyzing metrics and logs from Azure resources. It can be configured with metric alerts that trigger when CPU usage exceeds 90% for 5 minutes. Action Groups define the notification and response actions (e.g., email, SMS, webhook) that are executed when the alert fires, making them essential for sending alerts.

Answer

Log Analytics

Answer

Application Insights

Answer

Event Grid

Question 8

You need to assign permissions to an Azure resource group so that a user can create and manage virtual machines but cannot delete the resource group. What should you use?

Accepted Answer

Assign the Contributor role at the resource group level.. The Contributor role at the resource group level grants full management access to all resources within the resource group, including creating and managing virtual machines, but explicitly prevents the user from deleting the resource group itself. This meets the requirement because the Contributor role cannot perform management operations on the resource group scope, such as deletion, which is reserved for the Owner role.

Answer

Assign the Owner role at the resource group level.

Answer

Assign the Reader role at the resource group level.

Answer

Assign the User Access Administrator role at the resource group level.

Question 9

Your company uses Microsoft Entra ID for identity management. You need to ensure that users can access corporate resources without passwords while maintaining a high level of security. Which feature should you implement?

Accepted Answer

Passwordless authentication. Passwordless authentication (Option C) is correct because it allows users to access corporate resources without entering a password, using methods like Windows Hello for Business, FIDO2 security keys, or the Microsoft Authenticator app. This eliminates password-related risks (e.g., phishing, credential theft) while maintaining strong security through cryptographic key pairs or biometric verification, aligning with the requirement for both password-free access and high security.

Answer

Azure AD B2C

Answer

Conditional Access policies

Answer

Multifactor authentication (MFA)

Question 10

You are designing a governance strategy for Azure resources. The company has multiple departments, each requiring separate cost tracking and policy enforcement. You need to organize resources to align with the departments while minimizing management overhead. What should you use?

Accepted Answer

Management groups. Management groups are the correct choice because they allow you to organize Azure subscriptions into a hierarchy that aligns with your organizational structure, enabling you to apply Azure Policy and cost management controls at scale across multiple departments. By placing each department's subscriptions into separate management groups, you can enforce department-specific policies and track costs without managing each subscription individually, minimizing administrative overhead.

Answer

Azure Blueprints

Answer

Resource tags

Answer

Resource groups

Question 11

Your Azure environment includes multiple subscriptions that are managed by different teams. You need to ensure that all resources are compliant with your company's security policies, and any non-compliant resources must be automatically remediated or reported. Which solution should you implement?

Accepted Answer

Azure Policy with remediation tasks. Azure Policy with remediation tasks is the correct solution because it allows you to define and enforce security policies across multiple subscriptions, and automatically remediate non-compliant resources using managed identities and DeployIfNotExists or Modify policy effects. This ensures continuous compliance without manual intervention, meeting the requirement for both automatic remediation and reporting.

Answer

Azure Blueprints

Answer

Azure RBAC

Answer

Microsoft Defender for Cloud

Question 12

You need to monitor the performance and health of your Azure virtual machines, including custom metrics and logs. You also need to set up alerts based on specific thresholds. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct choice because it provides a comprehensive solution for collecting, analyzing, and acting on telemetry from Azure virtual machines, including custom metrics and logs. It integrates with the Azure Monitor Agent to gather performance counters and event logs, and supports metric alerts and log alerts based on specific thresholds, directly meeting all stated requirements.

Answer

Application Insights

Answer

Azure Service Health

Answer

Log Analytics

Question 13

Your organization uses Microsoft Entra ID and requires that all external users accessing resources must be approved by a designated reviewer. You need to automate the review process for external identities. What should you implement?

Accepted Answer

Microsoft Entra access reviews. Microsoft Entra access reviews allow you to automate the periodic review of external identities, ensuring that only approved users retain access. This feature directly supports the requirement for a designated reviewer to approve or deny external users, with automated reminders and results. It is the correct choice because it is purpose-built for governance of external identities in Entra ID.

Answer

Microsoft Purview

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Question 14

You are designing a monitoring solution for a critical application running on Azure Kubernetes Service (AKS). The application generates custom metrics that need to be queried in real-time for dashboards. You also need to retain logs for one year for compliance. Which combination of services should you use?

Accepted Answer

Azure Monitor Metrics and Azure Monitor Logs. Azure Monitor Metrics is the correct choice for real-time querying of custom metrics because it stores numeric time-series data with sub-minute granularity and supports near real-time alerting and dashboarding via Azure Dashboards or Grafana. Azure Monitor Logs (Log Analytics) is required for retaining logs for one year, as it offers configurable retention up to 730 days (2 years) and supports KQL queries for compliance and audit needs. Together, they provide a unified monitoring solution for AKS that meets both real-time metric querying and long-term log retention requirements.

Answer

Prometheus and Azure Monitor Logs

Answer

Azure Data Explorer and Azure Blob Storage

Answer

Application Insights and Azure Storage

Question 15

Your company plans to use Microsoft Sentinel for security information and event management (SIEM). You need to ingest security logs from multiple Azure resources and on-premises servers. Which data connector should you use for Windows servers on-premises?

Accepted Answer

Azure Monitor Agent. The Azure Monitor Agent (AMA) is the correct choice because it is the current, recommended data collection agent for Microsoft Sentinel, replacing the legacy Log Analytics agent. It supports collecting security logs from Windows servers on-premises via the Windows Security Events via AMA connector, which uses data collection rules (DCRs) for flexible, scalable log ingestion. AMA is optimized for Sentinel's SIEM requirements and provides better performance, security, and manageability than its predecessor.

Answer

Log Analytics agent

Answer

Microsoft Defender for Cloud agent

Answer

Azure Arc agent