AZ-305 Design identity, governance, and monitoring solutions Practice Test 9 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID and has a hybrid identity deployment with Active Directory Domain Services (AD DS) on-premises. You need to synchronize user identities to Microsoft Entra ID, but you must ensure that password hashes are never stored in the cloud. Which synchronization method should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pass-through Authentication (PTA). Pass-through Authentication (PTA) is the correct choice because it validates user passwords directly against on-premises Active Directory without ever storing password hashes in Azure AD. This meets the requirement that password hashes are never stored in the cloud, as PTA uses an agent on-premises to authenticate users, and only the validation result is sent to Azure AD.

Answer

Password Hash Sync

Answer

Federation with AD FS

Answer

Azure AD Connect Cloud Sync

Question 2

Your company has an Azure subscription with 100 virtual machines. You need to monitor the performance of these VMs and be alerted when the average CPU usage across a set of VMs exceeds 80% for 10 minutes. The set of VMs is defined by a tag (Environment=Production). Which Azure Monitor solution should you implement?

Accepted Answer

Use a Log Analytics query to calculate average CPU and set a log alert.. The requirement is to alert when the average CPU usage across a set of VMs (tagged Environment=Production) exceeds 80% for 10 minutes. Metric alert rules (including dynamic thresholds) evaluate per resource, not across multiple resources. Option D uses a Log Analytics query to calculate the average CPU usage across all VMs with the specified tag and then creates a log alert based on that query, which correctly aggregates the metric. Therefore, Option D is the correct solution.

Answer

Use Azure Monitor VM Insights to visualize performance and set alerts per VM.

Answer

Create a metric alert rule with a dynamic threshold and scope it to a resource group containing Production VMs.

Answer

Create a metric alert rule with a static threshold of 80% for each Production VM individually.

Question 3

Your organization uses Microsoft Purview to govern data across Azure and on-premises sources. You need to ensure that sensitive data, such as credit card numbers, is automatically detected and classified in Azure Blob Storage. Which Purview feature should you configure?

Accepted Answer

Data classification scanning with built-in sensitive information types. Microsoft Purview's data classification scanning can be configured to automatically detect sensitive data like credit card numbers using built-in sensitive information types (e.g., Credit Card Number). When a scan is run against Azure Blob Storage, Purview identifies and classifies the data based on these predefined patterns, enabling governance and compliance.

Answer

Microsoft Sentinel

Answer

Data catalog search

Answer

Data lineage tracking

Question 4

Your company has an Azure subscription that contains 100 virtual machines (VMs). You are designing a monitoring solution that must meet the following requirements: - Alert when any VM's CPU usage exceeds 90% for 15 minutes. - Alert when any VM's available memory drops below 1 GB. - Provide a centralized dashboard showing real-time performance metrics for all VMs. Which TWO Azure services should you include in the solution? (Choose two.)

Accepted Answer

Azure Monitor. Azure Monitor is the core service for collecting, analyzing, and acting on telemetry from Azure resources. It can collect CPU and memory metrics from VMs via the Azure Monitor Agent, and its alerting engine can trigger actions when CPU exceeds 90% for 15 minutes or available memory drops below 1 GB, meeting both alerting requirements.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Automation

Question 5

Your organization is designing a governance solution for multiple Azure subscriptions. You need to enforce that all resources are created in specific Azure regions (East US and West Europe only). Additionally, any resource group must have a cost center tag. Which THREE Azure components should you use? (Choose three.)

Accepted Answer

Azure Policy. Azure Policy is correct because it allows you to define and enforce rules for resource creation, such as restricting allowed locations to East US and West Europe. By assigning a built-in or custom policy definition to a management group or subscription, you can prevent any resource from being created outside the specified regions. This directly addresses the requirement to enforce regional compliance.

Answer

Azure Blueprints

Answer

Role-Based Access Control (RBAC)

Question 6

Refer to the exhibit. You are an Azure administrator reviewing a custom Azure Policy definition. What does this policy do?

Accepted Answer

Denies the creation of virtual machines with the SKUs Standard_D2s_v3 or Standard_D4s_v3.. The policy definition uses the 'deny' effect, which blocks any request that matches the specified condition. The condition checks if the virtual machine SKU is either 'Standard_D2s_v3' or 'Standard_D4s_v3' using the 'in' operator on the 'Microsoft.Compute/virtualMachines/sku.name' alias. Therefore, any attempt to create a VM with these SKUs will be denied, making Option A correct.

Answer

Denies the creation of resource groups that contain virtual machines with the specified SKUs.

Answer

Allows only virtual machines with the SKUs Standard_D2s_v3 or Standard_D4s_v3 to be created in a specific region.

Answer

Audits virtual machines to check if they have the SKUs Standard_D2s_v3 or Standard_D4s_v3.

Question 7

Refer to the exhibit. You are deploying a Log Analytics workspace using an ARM template with the parameters shown. Your compliance team requires that all log data be retained for at least 2 years. Which parameter value should you modify?

Accepted Answer

retentionInDays. The `retentionInDays` parameter controls how long log data is retained in a Log Analytics workspace. To meet the compliance requirement of at least 2 years (730 days), you must set this value to 730 or higher. The default retention is 30 days for free tiers and up to 730 days for paid tiers, but the parameter must be explicitly modified to enforce the 2-year retention.

Answer

workspaceName

Answer

sku

Answer

dailyQuotaGb

Question 8

Refer to the exhibit. You are deploying an ARM template that assigns a policy to audit virtual machines not using managed disks. After deployment, you need to verify that the policy assignment is working. Which Azure CLI command should you run?

Accepted Answer

az policy assignment list --subscription 12345678-1234-1234-1234-123456789abc. The `az policy assignment list` command retrieves all policy assignments in the specified subscription, including the one deployed via the ARM template. This allows you to confirm that the policy assignment exists and is properly configured. To verify that the policy is actually evaluating resources and producing compliance states, you would then use `az policy state list` to see the compliance results, but the question specifically asks to verify that the assignment itself is working, which is done by listing assignments.

Answer

az policy state list --resource-group myResourceGroup

Answer

az policy definition list --subscription 12345678-1234-1234-1234-123456789abc

Answer

az policy event list --subscription 12345678-1234-1234-1234-123456789abc

Question 9

Your company is deploying Microsoft Entra ID Governance and needs to ensure that guest users' access to internal applications expires after 90 days. Which feature should you configure?

Accepted Answer

Entitlement management. Entitlement management in Microsoft Entra ID Governance allows you to create access packages that govern guest user access to internal applications. You can configure an access package with a specific expiration policy, such as setting the access to expire after 90 days, ensuring automatic removal of guest access without manual intervention.

Answer

Privileged Identity Management (PIM)

Answer

Access reviews

Answer

Conditional Access policies

Question 10

Your organization uses Microsoft Sentinel for security monitoring. You need to ensure that all sign-in logs from Microsoft Entra ID are ingested into a Log Analytics workspace in real time. Which diagnostic setting should you configure?

Accepted Answer

SignInLogs. The SignInLogs diagnostic setting captures all user sign-in activities, including interactive and non-interactive sign-ins, which is required for real-time ingestion of all sign-in logs from Microsoft Entra ID into a Log Analytics workspace. This setting ensures that every authentication event is streamed to Sentinel for security monitoring without delay.

Answer

NonInteractiveUserSignInLogs

Answer

AuditLogs

Answer

ServicePrincipalSignInLogs

Question 11

Refer to the exhibit. You are a security administrator reviewing a custom Azure Policy assignment. The policy definition with ID 'abc123' is an initiative containing two policies: one that audits storage accounts with blob public access enabled and one that deploys a diagnostic setting for network security groups. The scope includes a production resource group. However, the compliance state shows 'Non-compliant' for several resources. What is the most likely reason for the non-compliance?

Accepted Answer

The diagnostic setting deployment policy requires a remediation task to bring non-compliant resources into compliance.. The policy that deploys a diagnostic setting for network security groups is a 'DeployIfNotExists' (DINE) policy. DINE policies do not automatically remediate existing non-compliant resources; they require a remediation task to be created and run, which will deploy the diagnostic settings to bring the resources into compliance. The audit-only policy for storage accounts does not require remediation, but the DINE policy's non-compliance indicates that the diagnostic settings are missing and need to be deployed via a remediation task.

Answer

The scope is incorrectly targeting the resource group, missing the subscription.

Answer

The audit policy is preventing the creation of storage accounts with public access.

Answer

The enforcement mode is set to 'Default' which disables policy evaluation.

Question 12

Your company is implementing a monitoring solution for Azure virtual machines. You need to collect performance counters and log events from the VMs and send them to a centralized Log Analytics workspace. Which agent should you install on the VMs?

Accepted Answer

Azure Monitor Agent. Azure Monitor Agent (AMA) is the current recommended agent for collecting performance counters and log events from Azure VMs and sending them to a Log Analytics workspace. It replaces the legacy Log Analytics agent (MMA) and offers centralized management via data collection rules (DCRs), improved security, and support for both Windows and Linux VMs. The AMA uses the Azure Monitor service pipeline and supports multi-homing to multiple workspaces natively.

Answer

Log Analytics agent (MMA)

Answer

Diagnostics Extension

Answer

Dependency Agent

Question 13

Your organization uses Azure Policy to enforce tagging standards. You need to ensure that any resource created without the required 'CostCenter' tag is automatically remediated by adding the tag with a default value. Which policy effect should you use?

Accepted Answer

modify. The 'modify' effect can add tags to resources during creation or on existing resources via remediation. Option A (append) is wrong because 'append' adds the tag at creation but does not support remediation for existing resources. Option B (deny) is wrong because 'deny' blocks creation, not add tags. Option D (audit) is wrong because 'audit' only logs non-compliance and does not add tags.

Answer

append

Answer

deny

Answer

audit

Question 14

Refer to the exhibit. A user reports they cannot access a secret in the vault 'vault-prod'. The user has a Contributor role at the subscription scope and a Key Vault Secrets User role at the specific vault scope. What is the most likely reason for the failure?

Accepted Answer

The vault uses access policies instead of RBAC for authorization.. The user has the Key Vault Secrets User role at the vault scope, which grants read permissions to secrets via Azure RBAC. However, if the vault is configured to use access policies instead of RBAC for authorization, the RBAC role assignment is ignored. In that case, the user must be granted explicit permissions through the vault's access policy to read secrets. The Contributor role at subscription scope does not include data plane permissions for Key Vault secrets.

Answer

The user does not have write permissions on the vault.

Answer

The Key Vault Secrets User role does not allow reading secrets.

Answer

The scope of the Key Vault Secrets User role is incorrect.

Question 15

Your company uses Azure Resource Manager templates for infrastructure deployment. You need to ensure that all deployments are validated against organizational policies before resources are provisioned. Which Azure service should you use?

Accepted Answer

Azure Policy. Azure Policy is correct because it can evaluate resource configurations against organizational policies before deployment, using effects like 'deny' or 'audit' to ensure compliance. Option A (Azure RBAC) is incorrect because it controls access permissions, not resource compliance. Option B (Management Groups) is incorrect because they organize subscriptions for management but do not enforce policy validation. Option D (Azure Blueprints) is incorrect because it bundles artifacts like policies and role assignments, but the policy enforcement itself comes from Azure Policy.

Answer

Azure RBAC

Answer

Management Groups

Answer

Azure Blueprints