AZ-305 Design identity, governance, and monitoring solutions Practice Test 9 — 15 Questions

Question 1

A company plans to migrate on-premises applications to Azure. They require users to authenticate using their existing on-premises Active Directory credentials without syncing password hashes to the cloud. Which Microsoft Entra ID authentication method should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra ID Pass-through Authentication. Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud. A lightweight agent on-premises forwards authentication requests to the local domain controller, meeting the requirement to avoid password hash synchronization.

Answer

Microsoft Entra ID Password Hash Sync

Answer

Microsoft Entra ID Federation Services (AD FS)

Answer

Microsoft Entra ID Connect with Seamless SSO

Question 2

A multinational company uses Microsoft Entra ID and several Azure subscriptions. Security administrators need to review privileged role assignments every month and require justification for continued access. Which design should be recommended?

Accepted Answer

Microsoft Entra Privileged Identity Management with access reviews. Microsoft Entra Privileged Identity Management (PIM) with access reviews is the correct design because it provides time-bound, just-in-time privileged role assignments and requires users to periodically justify their continued access through automated access reviews. This directly meets the monthly review and justification requirement for privileged roles, as PIM integrates with Entra ID to enforce approval workflows and expiration policies.

Answer

Azure Monitor metric alerts

Answer

Management group locks

Answer

Azure Policy guest configuration

Question 3

A company wants workload deployments to access Azure resources without storing client secrets in CI/CD variables. The pipeline runs from GitHub Actions. Which identity design should be used?

Accepted Answer

Workload identity federation with Microsoft Entra ID. Workload identity federation with Microsoft Entra ID allows GitHub Actions to exchange an OpenID Connect (OIDC) token for an Azure access token, eliminating the need to store client secrets in CI/CD variables. This design uses short-lived tokens and federated identity credentials, aligning with the principle of zero-trust and secretless authentication.

Answer

A shared user account with MFA disabled

Answer

A storage account access key

Answer

A long-lived app registration client secret

Question 4

A SaaS application must allow external partner users to sign in with their own organization credentials while the company controls application access. What should be used?

Accepted Answer

Microsoft Entra External ID/B2B collaboration with Conditional Access. Microsoft Entra External ID (formerly Azure AD B2B) enables external partner users to sign in using their own organization's credentials (their existing Microsoft Entra ID or Microsoft account) while the company retains control over application access. By combining B2B collaboration with Conditional Access policies, the company can enforce MFA, device compliance, or location-based controls on guest users without managing their identities or passwords.

Answer

Create local cloud-only accounts for every partner user

Answer

Share one account per partner company

Answer

Use Azure DNS private zones

Question 5

An organization wants to enforce MFA only when sign-in risk is medium or high. Which Microsoft Entra capability should be used?

Accepted Answer

Conditional Access with Identity Protection risk signals. Conditional Access policies can integrate with Microsoft Entra Identity Protection risk signals to enforce MFA based on the calculated sign-in risk level (low, medium, high). When the risk is medium or high, the policy triggers MFA, meeting the requirement precisely. This is the only Microsoft Entra capability that directly uses risk-based conditional enforcement.

Answer

Azure RBAC deny assignments only

Answer

Access reviews only

Answer

Administrative units only

Question 6

Drag and drop the steps to implement Azure Site Recovery for a Hyper-V VM into the correct order.

Accepted Answer

Create the vault, then ensure network connectivity, then install the provider and agent, then create and apply a replication policy, then enable replication.. First, create the vault. Then ensure network connectivity. Install the provider and agent. Create and apply a replication policy. Finally, enable replication.

Answer

Install the provider and agent, then create the vault, then ensure network connectivity, then create and apply a replication policy, then enable replication.

Answer

Create the vault, then ensure network connectivity, then create and apply a replication policy, then install the provider and agent, then enable replication.

Answer

Enable replication, then create the vault, then ensure network connectivity, then install the provider and agent, then create and apply a replication policy.

Question 7

Drag and drop the steps to implement Azure AD Privileged Identity Management (PIM) for a role into the correct order.

Accepted Answer

Select role, Configure settings, Assign eligible members, Set notifications, Test activation. Select role, configure settings, assign eligible members, set notifications, then test activation.

Answer

Select role, Assign eligible members, Configure settings, Set notifications, Test activation

Answer

Configure settings, Select role, Assign eligible members, Set notifications, Test activation

Answer

Select role, Configure settings, Set notifications, Assign eligible members, Test activation

Question 8

Match each Azure service to its primary function.

Accepted Answer

Azure Virtual Network: Enables private connectivity between Azure resources.. Correct matches: Azure Virtual Network provides private connectivity; Azure Load Balancer distributes traffic. Common confusions mix layer-4 and layer-7 services, and regional vs. global routing.

Answer

Azure VPN Gateway: Provides application-layer load balancing and web application firewall.

Answer

Azure Application Gateway: Routes incoming traffic across global Azure regions based on routing methods.

Answer

Azure Traffic Manager: Connects on-premises networks to Azure via encrypted tunnels.

Question 9

Match each Azure compute service to its characteristic.

Accepted Answer

Virtual Machines: Provides full control over the operating system and allows custom software installation.. Azure compute services range from IaaS (Virtual Machines) to PaaS (App Service) to serverless (Azure Functions) and container orchestration (AKS). Distractors confuse definitions of serverless and container orchestration, or PaaS and managed Kubernetes.

Answer

Azure Functions: Managed container orchestration service for deploying and managing containerized applications.

Answer

Azure Kubernetes Service: Managed platform for building, deploying, and scaling web apps and APIs.

Question 10

Match each Azure migration tool to its use case.

Accepted Answer

Azure Migrate: Assess and migrate on-premises servers to Azure.. Azure Migrate is for server assessment/migration, Azure Site Recovery for disaster recovery, and Azure Database Migration Service for database migrations. Common confusions involve swapping these use cases.

Answer

Azure Migrate: Automate disaster recovery and failover.

Answer

Azure Site Recovery: Assess and migrate on-premises servers to Azure.

Answer

Azure Database Migration Service: Transfer large amounts of data via physical device.

Question 11

Your company has a Microsoft Entra ID tenant with 10,000 users. You plan to grant external partners access to a specific SharePoint Online site using Microsoft Entra B2B collaboration. You need to ensure that partners can authenticate using their own corporate credentials. What should you configure?

Accepted Answer

Microsoft Entra B2B collaboration with external identities. Microsoft Entra B2B collaboration allows external partners to authenticate using their own corporate credentials (such as Microsoft Entra ID, Microsoft account, or other identity providers) without requiring a separate password or local account. This is the correct solution because it directly supports the requirement for partners to use their own identity providers, enabling seamless access to the SharePoint Online site via guest user invitations.

Answer

Cross-tenant synchronization

Answer

Conditional Access policy for guest users

Answer

Microsoft Entra guest user accounts with password

Question 12

Your organization is moving to a cloud-only identity model using Microsoft Entra ID. You need to ensure that users can reset their own passwords without help desk intervention. The solution must support multi-factor authentication and notify administrators of password resets. What should you implement?

Accepted Answer

Microsoft Entra Self-Service Password Reset (SSPR). Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords without help desk intervention. It supports multi-factor authentication (MFA) as a verification step before resetting, and can be configured to send notifications to administrators when a password reset occurs. This directly meets all stated requirements.

Answer

Microsoft Entra Connect Password Writeback

Answer

Conditional Access policies for password change

Answer

Microsoft Entra ID Protection

Question 13

Refer to the exhibit. You deploy this Azure Monitor scheduled query rule to alert when CPU usage exceeds 90% for sustained periods. However, alerts are not firing even when the condition is met. What is the most likely cause?

Accepted Answer

The threshold of 5 with 'Count' aggregation requires more than 5 data points above 90% in the window, which may not be happening.. The alert rule uses a 'Count' aggregation with a threshold of 5, meaning the alert fires only when the number of data points exceeding 90% CPU within the evaluation window is greater than 5. If the sustained high CPU usage produces fewer than 5 such data points (e.g., due to a short burst or insufficient sampling), the condition is not met, and the alert will not fire. This is a common misconfiguration where the threshold value is set too high relative to the actual data point frequency.

Answer

The KQL query syntax is incorrect and returns no results.

Answer

The action group is not configured with a valid email address.

Answer

The evaluation frequency is too short compared to the window size.

Question 14

Your company uses Microsoft Entra ID to manage identities for 5,000 employees. You plan to implement Microsoft Entra ID Governance to automate the user provisioning lifecycle for a third-party SaaS application. The application supports SCIM 2.0. You need to ensure that user accounts are automatically created, updated, and disabled in the application based on changes in Entra ID. What should you do?

Accepted Answer

Configure automatic provisioning in Microsoft Entra ID using the SCIM endpoint. Microsoft Entra ID's automatic provisioning feature natively supports SCIM 2.0 endpoints, enabling automated creation, update, and deactivation of user accounts in third-party SaaS applications based on changes in Entra ID. This eliminates the need for custom code and provides a managed, scalable solution for the user provisioning lifecycle.

Answer

Use Microsoft Graph API to write a custom provisioning solution

Answer

Configure Microsoft Entra B2B collaboration for the application

Answer

Publish the application using Microsoft Entra Application Proxy

Question 15

You are designing a monitoring solution for Azure SQL Database. The requirement is to track query performance metrics such as CPU usage, data IO, and wait statistics over time. You need to identify performance bottlenecks and provide historical data for analysis. Which Azure service should you use?

Accepted Answer

Query Performance Insight for Azure SQL Database. Query Performance Insight for Azure SQL Database is the correct choice because it provides built-in, intelligent analysis of top queries by CPU, data IO, and wait statistics over time, enabling you to identify performance bottlenecks and review historical data. It is specifically designed for Azure SQL Database and offers a customizable time range for trend analysis, directly meeting the requirement to track query performance metrics and analyze historical data.

Answer

Azure Monitor Metrics for Azure SQL Database

Answer

Azure SQL Analytics (preview) in Azure Monitor

Answer

Azure SQL Database Intelligent Insights