AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Microsoft Entra Privileged Identity Management (PIM) to require activation for access to critical applications.

  Why it's wrong here

  PIM is a privileged access management service that provides just-in-time activation for high-privilege roles such as Global Administrator, requiring approval or MFA at the time of activation. It does not perform recurring certifications of standard user access to business applications, nor does it support a 7-day auto-approve fallback for non-responsive reviewers. Since the requirement is about periodic access reviews with automatic approval, PIM cannot fulfill it.

• ✗

  Create an access review with 'Auto deny' after 7 days of no response.

  Why it's wrong here

  Within Entra ID access reviews, you can specify a default action for reviewers who do not respond; choosing 'auto deny' would automatically remove access after the review deadline if the manager does not respond. However, the requirement explicitly states that access should be approved if no response within 7 days, so auto-deny is the opposite of what's needed. It would cause users to lose access and is therefore incorrect, even though it is a valid configuration option in access reviews.

• ✗

  Create a recurring campaign in Microsoft Purview Compliance Manager.

  Why it's wrong here

  Microsoft Purview Compliance Manager is a compliance management console that tracks regulatory controls, calculates compliance scores, and provides improvement actions; it is not an access governance tool. It cannot create user access review workflows, assign managers as reviewers, or configure an automatic approve/deny decision based on reviewer inactivity. Access reviews are implemented in Microsoft Entra ID governance, so this option does not meet the requirement.

• ✓

  Create an access review with 'Auto approve' after 7 days of no response.

  Why this is correct

  Configuring an access review with the auto-approve fallback directly aligns with the business rule: the review is created in Microsoft Entra ID, managers are assigned as reviewers, and a recurrence schedule is set. When the 7-day response window lapses, the system automatically applies an 'approve' decision for each pending access, preserving user access. This ensures that access is recertified periodically without being disrupted by manager delays, satisfying the requirement precisely.

Go deeper

Related to this question