A company has multiple Azure subscriptions and wants to enforce that all administrators must use multi-factor authentication (MFA) when accessing the Azure portal. They also want to monitor and report on any policy changes that affect this enforcement. Which combination of Azure services should they use?

Azure Policy with built-in policy to enforce MFA and Azure Activity Log to monitor changes.

Azure Policy can audit whether MFA is enabled on accounts, but it cannot enforce MFA during sign-in. It is not the correct tool for requiring MFA at authentication time. Activity Log can capture policy changes, but the enforcement method is wrong.

Microsoft Entra ID Identity Protection to enforce MFA and Azure Sentinel for monitoring.

Identity Protection offers risk-based conditional access (e.g., require MFA for risky sign-ins), but it is not designed to enforce MFA for all administrators regardless of risk. Azure Sentinel is a SIEM that could ingest logs, but it is unnecessary for the stated requirement for basic monitoring of policy changes; Azure Monitor is simpler and sufficient.

Azure Policy to assign built-in policy 'MFA should be enabled on accounts with write permissions' and Azure Security Center for monitoring.

This policy audits whether MFA is enabled, but again does not enforce MFA during authentication. Azure Security Center (now Defender for Cloud) focuses on security posture and workload protection, not on monitoring identity policy changes.

What does this AZ-305 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Microsoft Entra ID Conditional Access policy to require MFA for Azure management and Azure Monitor with Log Analytics for monitoring. — Microsoft Entra ID Conditional Access allows you to create policies that require MFA for specific cloud apps, such as Azure Management. This ensures MFA is enforced for Azure portal access. To monitor policy changes, you should use Azure Monitor to collect Activity Logs and create alerts for changes to Conditional Access policies. Alternatively, Azure Policy can audit MFA status, but it cannot enforce MFA for Azure portal access. Microsoft Entra ID Identity Protection is about risk-based policies, not basic MFA enforcement. Azure Sentinel is a SIEM that can ingest logs but is not necessary for basic monitoring.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.