The correct choice is to use the built-in 'Brute force attack against an Entra ID account' analytics rule in Microsoft Sentinel and connect a playbook to disable the user. This design works because Sentinel’s built-in rule natively ingests sign-in logs from Microsoft Entra ID and triggers an incident when repeated failed authentication attempts exceed a threshold, while a connected playbook—typically an Azure Logic App—can execute an automated response such as temporarily disabling the compromised account via the Microsoft Graph API. On the AZ-305 exam, this scenario tests your ability to leverage prebuilt security content rather than custom KQL queries, and a common trap is overcomplicating the solution with custom analytics rules or manual response steps. Remember that Sentinel’s out-of-the-box rules are designed for exactly this kind of identity threat detection, so always check for a built-in rule before building from scratch. A useful memory tip: “Built-in rule + playbook = automated disable” ties the detection directly to the remediation without extra code.
AZ-305 Practice Question: Design identity, governance, and monitoring solutions
This AZ-305 practice question tests your understanding of design identity, governance, and monitoring solutions. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your company uses Microsoft Entra ID and has recently deployed Microsoft Sentinel. You need to design a monitoring solution to detect brute-force attacks against user accounts. The solution should use built-in analytics rules where possible and must trigger an automated response to temporarily disable the affected account. What should you include in the design?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the built-in 'Brute force attack against an Entra ID account' analytics rule in Microsoft Sentinel and connect a playbook to disable the user.
Option A is correct because Microsoft Sentinel includes a built-in analytics rule specifically for detecting brute-force attacks against Microsoft Entra ID accounts. By connecting a playbook to this rule, you can automate the response to temporarily disable the affected user account, meeting the requirement for an automated response without custom development.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Use the built-in 'Brute force attack against an Entra ID account' analytics rule in Microsoft Sentinel and connect a playbook to disable the user.
Why this is correct
Built-in rule and playbook provide automated detection and response.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use Microsoft Entra Identity Protection to detect brute-force and configure a conditional access policy to block sign-ins.
Why it's wrong here
Identity Protection can block but does not disable the account.
✗
Stream sign-in logs to Log Analytics and create a scheduled query that alerts on multiple failures, then manually disable accounts.
Why it's wrong here
Manual response is not automated.
✗
Create a custom KQL query in Microsoft Sentinel and configure an automation rule to disable the account.
Why it's wrong here
Built-in rule is simpler and recommended.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse Microsoft Entra Identity Protection's ability to block sign-ins with the requirement to disable the user account, or they may overlook the 'use built-in analytics rules where possible' constraint and opt for a custom KQL query.
Detailed technical explanation
How to think about this question
The built-in 'Brute force attack against an Entra ID account' analytics rule in Sentinel leverages sign-in logs and threat intelligence to detect patterns of repeated failed attempts. When triggered, it can invoke a playbook via automation rules, which can execute actions like disabling the user in Entra ID using the Microsoft Graph API. This approach ensures low-latency response and reduces manual overhead in high-volume environments.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-305 question in full detail.
Design identity, governance, and monitoring solutions — This question tests Design identity, governance, and monitoring solutions — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use the built-in 'Brute force attack against an Entra ID account' analytics rule in Microsoft Sentinel and connect a playbook to disable the user. — Option A is correct because Microsoft Sentinel includes a built-in analytics rule specifically for detecting brute-force attacks against Microsoft Entra ID accounts. By connecting a playbook to this rule, you can automate the response to temporarily disable the affected user account, meeting the requirement for an automated response without custom development.
What should I do if I get this AZ-305 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.