AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A large enterprise wants to enforce zero-trust conditional access policies that use real-time user risk, sign-in risk, and device compliance. Which combination of Microsoft Entra ID features should they use?
⚠ Common exam trap
Many exam-takers confuse Privileged Identity Management (PIM) with risk-based conditional access, but PIM only manages role activation and does not evaluate user/sign-in risk or device compliance in real time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Identity Protection and Conditional Access
Microsoft Entra ID Identity Protection provides real-time risk detection for users and sign-ins, while Conditional Access policies can enforce access controls based on those risk signals and device compliance. Together, they enable zero-trust conditional access by blocking or requiring MFA when user or sign-in risk is high, and ensuring only compliant devices can access resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Identity Protection and Conditional Access
Why this is correct
Identity Protection evaluates millions of signals per sign-in to calculate user and sign-in risk, detecting anomalies such as leaked credential use, impossible travel, and anomalous token behavior. Conditional Access then consumes those risk signals in real time to enforce step-up authentication (e.g., MFA or password change) or block access entirely, operationalizing zero trust at the identity plane with adaptive, context-aware policies.
- ✗
Microsoft Entra ID Privileged Identity Management and Access Reviews
Why it's wrong here
Privileged Identity Management (PIM) provides just-in-time assignment and approval workflows for highly privileged roles, while Access Reviews periodically recertify those assignments to remove stale entitlements. These governance controls reduce standing privilege and audit the lifecycle of admin access, but they do not analyze sign-in risk or enforce conditional policies when a user authenticates, so they don't deliver risk-based zero-trust checkpointing.
- ✗
Microsoft Entra ID B2B and External Identities
Why it's wrong here
B2B (External Identities) allows you to invite guest users from other tenants or policy-enabled social identity providers and manage their collaboration-specific access via Entra ID tenant settings. External Identities configuration focuses on bringing external users into your directory for resource sharing, not on calculating the risk of a given authentication attempt, and it lacks the risk-detection telemetry needed to make real-time access decisions.
- ✗
Microsoft Entra ID Domain Services and Managed Identities
Why it's wrong here
Microsoft Entra ID Domain Services (formerly Azure AD DS) supplies legacy authentication protocols like NTLM and Kerberos, LDAP, and group policy for domain-joined VMs, whereas Managed Identities are Microsoft Entra ID-backed service principals that grant applications a rotation-automated identity for accessing Azure resources. Neither component inspects or scores identity risk; they are infrastructure-level capabilities that support resource connectivity and authentication, not conditional access engines.
Go deeper
Related to this question
About these practice questions
One of 795 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.