AZ-305 Practice Question: Design identity, governance, and monitoring solutions
This AZ-305 practice question tests your understanding of design identity, governance, and monitoring solutions. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: identity Protection detects identity-based risks like leaked credentials.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Microsoft Entra ID (Microsoft Entra ID). They need to automatically detect sign-ins from users with leaked credentials and prompt those users to reset their password during the next sign-in. Which Microsoft Entra ID feature should they enable?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Identity Protection
Microsoft Entra ID Identity Protection includes a 'Leaked Credentials' detection capability that continuously monitors for credentials exposed in known data breaches. When a user's credentials are detected as leaked, Identity Protection can automatically trigger a password reset during the next sign-in, ensuring the compromised credentials are no longer usable.
Key principle: Identity Protection detects identity-based risks like leaked credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Microsoft Entra ID Identity Protection
Why this is correct
Identity Protection detects risks like leaked credentials and can trigger automated remediation such as password reset.
Related concept
Identity Protection detects identity-based risks like leaked credentials.
✗
Conditional Access
Why it's wrong here
Conditional Access can use risk conditions from Identity Protection but does not detect risks itself.
✗
Privileged Identity Management (PIM)
Why it's wrong here
PIM manages privileged roles, not user risk remediation.
✗
Microsoft Entra ID B2B
Why it's wrong here
B2B is for inviting external users, not risk detection and password reset.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Conditional Access (which can enforce password changes via a 'Require password change' grant control) with Identity Protection, but Conditional Access alone cannot detect leaked credentials—it only enforces policies after a risk is detected by Identity Protection.
Detailed technical explanation
How to think about this question
Identity Protection uses Microsoft's Threat Intelligence and the Microsoft Defender for Identity sensor to match user password hashes against a database of billions of leaked credentials. When a match is found, the user's risk level is elevated, and a 'User risk policy' can be configured to require a secure password change via the Microsoft Graph API's 'forceChangePasswordNextSignIn' property. This process is independent of on-premises Active Directory and works for cloud-only or synced users.
KKey Concepts to Remember
Identity Protection detects identity-based risks like leaked credentials.
It can automate remediation actions, such as requiring a password reset.
Risk detection is based on real-time and offline analysis of sign-in and user behavior.
Identity Protection integrates with Conditional Access to enforce policies based on risk levels.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Identity Protection detects identity-based risks like leaked credentials.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-305 question in full detail.
Review identity Protection detects identity-based risks like leaked credentials., then practise related AZ-305 questions on the same topic to reinforce the concept.
Design identity, governance, and monitoring solutions — This question tests Design identity, governance, and monitoring solutions — Identity Protection detects identity-based risks like leaked credentials..
What is the correct answer to this question?
The correct answer is: Microsoft Entra ID Identity Protection — Microsoft Entra ID Identity Protection includes a 'Leaked Credentials' detection capability that continuously monitors for credentials exposed in known data breaches. When a user's credentials are detected as leaked, Identity Protection can automatically trigger a password reset during the next sign-in, ensuring the compromised credentials are no longer usable.
What should I do if I get this AZ-305 question wrong?
Review identity Protection detects identity-based risks like leaked credentials., then practise related AZ-305 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Identity Protection detects identity-based risks like leaked credentials.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.