I85PREP
⌘ K
Azure AZ-305 study materials
Azure AZ-305 study resources

Azure AZ-305 practice questions

One question at a time. Build your Azure AZ-305 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Design identity, governance, and monitoring solutions

Which Azure AD capability evaluates sign-in signals and can require multifactor authentication when a user signs in from an unfamiliar location?

  1. Conditional Access Correct answer.
  2. Privileged Identity Management
  3. Entitlement management
  4. Access reviews

Explanation

Conditional Access evaluates signals such as user, device, location, and application, then enforces controls like multifactor authentication or block. The other features govern privileged role activation, access recertification, or access package requests rather than sign-in condition evaluation.

Question 2Design identity, governance, and monitoring solutions

A user must be able to create and manage all resource types in a subscription but must not be able to grant access to other users. Which built-in role should be assigned?

  1. User Access Administrator
  2. Owner
  3. Reader
  4. Contributor Correct answer.

Explanation

Contributor can create and manage all resource types but cannot grant access to others. Owner includes the ability to assign roles, Reader is read-only, and User Access Administrator manages access assignments rather than resource configuration.

Question 3Design identity, governance, and monitoring solutions

At which scope can an Azure Policy assignment be applied to govern the largest set of subscriptions?

  1. A resource group
  2. An individual resource
  3. A management group Correct answer.
  4. A subscription

Explanation

Azure Policy assignments can target management groups, subscriptions, resource groups, or individual resources. A management group is the broadest built-in scope and can contain multiple subscriptions.

Question 4Design identity, governance, and monitoring solutions

Which Azure service provides a centralized workspace where you can store, query, and analyze log data from multiple Azure resources?

  1. An Azure Storage account
  2. An Application Insights resource
  3. A Log Analytics workspace Correct answer.
  4. An Azure Event Hubs namespace

Explanation

A Log Analytics workspace is the central data store and query environment for Azure Monitor logs collected from multiple resources. Storage accounts archive data, Event Hubs ingests streaming data, and Application Insights focuses on application telemetry.

Question 5Design identity, governance, and monitoring solutions

Which Azure AD feature enables eligible users to activate a privileged role for a limited time, optionally after approval?

  1. Conditional Access policies
  2. Azure AD Identity Protection
  3. Privileged Identity Management Correct answer.
  4. Access reviews of group membership

Explanation

Privileged Identity Management provides just-in-time activation, time-bound assignments, and optional approval for privileged roles. Conditional Access enforces sign-in controls, Identity Protection detects risk, and access reviews recertify access.

Question 6Design identity, governance, and monitoring solutions

Which resource lock level allows a resource to be modified but prevents it from being deleted?

  1. None, which applies no restriction
  2. ReadOnly, which blocks updates and deletes
  3. Delete, which blocks only deletes
  4. CanNotDelete, which blocks only deletes Correct answer.

Explanation

CanNotDelete permits read and update operations while blocking deletion. ReadOnly blocks both modifications and deletion, and None applies no lock.

Question 7Design identity, governance, and monitoring solutions

Which Azure service provides best-practice recommendations for cost, security, reliability, operational excellence, and performance?

  1. Azure Monitor
  2. Azure Policy
  3. Azure Advisor Correct answer.
  4. Microsoft Cost Management

Explanation

Azure Advisor analyzes resource configuration and usage and produces recommendations across cost, security, reliability, operational excellence, and performance. Policy enforces rules, Monitor collects telemetry, and Cost Management analyzes spend.

Question 8Design identity, governance, and monitoring solutions

Which hybrid identity authentication method validates user passwords against on-premises Active Directory by using an outbound-only agent, without storing password hashes in Azure AD?

  1. Seamless single sign-on
  2. Password hash synchronization
  3. AD FS federation
  4. Pass-through authentication Correct answer.

Explanation

Pass-through authentication uses an on-premises authentication agent that validates credentials against AD and requires only outbound connections. Password hash synchronization stores hashes in Azure AD, AD FS requires federation infrastructure, and Seamless SSO does not itself validate passwords.

Question 9Design identity, governance, and monitoring solutions

A company must prevent new resources from being deployed in regions outside its approved list. Which governance feature should be used?

  1. A management group hierarchy with inherited subscriptions
  2. A ReadOnly resource lock
  3. Azure RBAC with a custom role
  4. Azure Policy with an allowed locations definition Correct answer.

Explanation

Azure Policy can deny deployments that do not match the allowed locations definition. RBAC controls which actions a principal can perform, resource locks prevent changes or deletion, and management groups organize scopes but do not enforce region restrictions.

Question 10Design identity, governance, and monitoring solutions

A security team needs to periodically recertify guest access and automatically remove guests who do not respond. Which Azure AD feature should they use?

  1. Conditional Access
  2. Entitlement management
  3. Privileged Identity Management
  4. Access reviews Correct answer.

Explanation

Access reviews let reviewers recertify group membership or application access on a schedule, with options to remove access for non-responders. Conditional Access enforces sign-in controls, PIM manages privileged roles, and entitlement management manages access packages.

Question 11Design identity, governance, and monitoring solutions

You need to notify an on-call team by SMS and create an incident in an IT service management tool when an Azure Monitor alert fires. What should you configure on the alert?

  1. A workbook
  2. An action group Correct answer.
  3. A metric alert rule
  4. A diagnostic setting

Explanation

Action groups define the notifications and actions, such as SMS, email, webhook, ITSM, or Automation runbook, that run when an alert triggers. Diagnostic settings route logs, workbooks visualize data, and the alert rule defines the condition.

Question 12Design identity, governance, and monitoring solutions

An organization has many subscriptions and wants to apply Azure Policy and RBAC assignments consistently to groups of subscriptions. What should it create?

  1. Subscriptions
  2. Resource groups
  3. Management groups Correct answer.
  4. Azure AD security groups

Explanation

Management groups provide a hierarchy above subscriptions so policy and RBAC assignments can be inherited by many subscriptions. Resource groups are within subscriptions, and Azure AD security groups are identity objects rather than Azure scope containers.

Question 13Design identity, governance, and monitoring solutions

A company wants external partners to access its Teams and SharePoint resources by signing in with their own work credentials. Which Azure AD capability should be used?

  1. Conditional Access
  2. Azure AD B2C
  3. Privileged Identity Management
  4. B2B collaboration Correct answer.

Explanation

B2B collaboration invites external users as guests who authenticate with their home identity provider. B2C is for customer-facing applications, PIM is for privileged roles, and Conditional Access enforces access policies.

Question 14Design identity, governance, and monitoring solutions

An application running on an Azure virtual machine must read secrets from Azure Key Vault without storing credentials in code or configuration. What should be configured?

  1. A service principal with a client secret
  2. A shared access signature
  3. A storage account access key
  4. A managed identity Correct answer.

Explanation

A managed identity gives the VM an Azure AD identity whose token can authenticate to Key Vault, eliminating stored credentials. Service principals require secret management, while SAS tokens and storage keys apply to storage rather than Key Vault authentication.

Question 15Design identity, governance, and monitoring solutions

You need to alert when the average response time of an Azure App Service app exceeds a threshold over five minutes. Which signal should the alert rule use?

  1. Activity log
  2. Diagnostic logs
  3. Metrics Correct answer.
  4. Resource health

Explanation

Platform metrics include performance counters such as response time, and metric alert rules evaluate them over time windows. Activity log records control-plane events, resource health reports service availability, and diagnostic logs are event text routed to destinations.

Question 16Design identity, governance, and monitoring solutions

A company wants to require a CostCenter tag on all resources and automatically inherit the value from the resource group when it is missing. Which feature should be used?

  1. Azure RBAC
  2. Resource locks
  3. Azure Policy Correct answer.
  4. Azure Blueprints

Explanation

Azure Policy can deny or modify resources that lack required tags and can use the modify effect with tag inheritance from the resource group. Locks and RBAC do not enforce tags, while Blueprints package artifacts but tag enforcement is performed by Policy.

Question 17Design identity, governance, and monitoring solutions

A team must manage all resources in a single resource group but must not affect other resource groups in the subscription. At which scope should the role assignment be created?

  1. The resource group Correct answer.
  2. Each individual resource
  3. The management group
  4. The subscription

Explanation

RBAC assignments are inherited downward, so assigning at the resource group limits the team to that group. Subscription or management group scope would grant access to more resources.

Question 18Design identity, governance, and monitoring solutions

Users need to request access to a bundle of groups, applications, and SharePoint sites, with manager approval and automatic expiry. Which Azure AD feature should be used?

  1. Entitlement management Correct answer.
  2. Conditional Access
  3. Privileged Identity Management
  4. Access reviews

Explanation

Entitlement management uses access packages to bundle resources, define approval, and set expiration. Access reviews recertify existing access, PIM activates roles, and Conditional Access enforces sign-in controls.

Question 19Design identity, governance, and monitoring solutions

What is the purpose of an Azure Monitor diagnostic setting on a resource?

  1. To visualize telemetry in workbooks
  2. To route resource logs and metrics to a destination Correct answer.
  3. To define the threshold, severity, and evaluation frequency of an alert
  4. To collect guest OS performance counters only

Explanation

Diagnostic settings specify which logs and metrics a resource emits and where they are sent, such as Log Analytics, storage, or Event Hubs. Alert rules define thresholds, workbooks visualize data, and guest OS counters require the Azure Monitor agent.

Question 20Design identity, governance, and monitoring solutions

A company wants to detect and alert when an administrator deletes a virtual machine in a subscription. Which Azure Monitor data source should be used?

  1. Metrics
  2. Application Insights
  3. Resource health
  4. Activity log Correct answer.

Explanation

The activity log records subscription-level control-plane events such as delete operations, and activity log alerts can notify on them. Metrics are performance data, resource health reports availability, and Application Insights monitors application telemetry.

Question 21Design identity, governance, and monitoring solutions

A company collaborates with a partner tenant. Users from the partner must access the company's apps with their home tenant credentials, and the company wants to trust MFA performed by the partner tenant. Which configuration should be used?

  1. AD FS federation with the partner's domain and claims rules
  2. Password hash synchronization with the partner's on-premises AD
  3. B2B collaboration with cross-tenant MFA trust Correct answer.
  4. An Azure AD B2C tenant with a custom policy for partners

Explanation

Cross-tenant access settings in Azure AD B2B let a resource tenant trust MFA and device claims from a partner tenant. B2C is for customer identities, while AD FS and password hash synchronization are for integrating your own directory rather than partner guest access.

Question 22Design identity, governance, and monitoring solutions

A company must keep Azure Monitor logs queryable for 90 days and retain them for seven years at the lowest cost. Which Log Analytics workspace configuration should be used?

  1. Set the workspace retention to seven years
  2. Set the workspace retention to 90 days and rely on Application Insights sampling
  3. Set interactive retention to 90 days and total retention to seven years Correct answer.
  4. Export all logs to a storage account and disable workspace retention

Explanation

Log Analytics separates interactive retention, where data is directly queryable, from total retention, which extends data into long-term storage for search jobs. This meets the query and cost requirements without keeping all data hot. Keeping seven years interactive costs more, and storage export adds operational overhead.

Question 23Design identity, governance, and monitoring solutions

A company wants Azure Policy to automatically deploy a missing diagnostic setting on resources that do not have one. Which policy effect should be used?

  1. The DeployIfNotExists effect Correct answer.
  2. The Deny effect
  3. The Modify effect
  4. The Audit effect with a compliance dashboard

Explanation

DeployIfNotExists evaluates whether a related resource exists and, if not, deploys it through a remediation task. Audit only reports noncompliance, Deny blocks deployments, and Modify changes properties on the evaluated resource itself.

Question 24Design identity, governance, and monitoring solutions

You need to identify which downstream service in a distributed application is causing increased latency by viewing dependencies between components. Which Application Insights feature should you use?

  1. Application Map Correct answer.
  2. Metrics explorer
  3. Log Analytics workspace
  4. Availability tests

Explanation

Application Map visualizes the components and dependencies of a distributed application and highlights failure and latency hotspots. Metrics explorer charts individual metrics, availability tests probe endpoints, and Log Analytics queries logs without the dependency map view.

Question 25Design identity, governance, and monitoring solutions

A company assigns an Azure Policy with the DeployIfNotExists effect and wants to bring existing non-compliant resources into compliance. What should be done?

  1. Move the resources to a new management group
  2. Change the policy effect from DeployIfNotExists to Audit
  3. Create an exemption for the affected resources
  4. Run a policy remediation task Correct answer.

Explanation

Remediation tasks apply the policy's remediation logic, such as deploying a missing setting, to existing resources. Exemptions waive compliance, changing to Audit stops enforcement, and moving scopes does not fix the resource configuration.

Question 26Design identity, governance, and monitoring solutions

Which Microsoft Entra ID license is required for just-in-time role activation with approval and time-bound assignments through Privileged Identity Management?

  1. Microsoft 365 Business Basic
  2. Microsoft Entra ID P2 Correct answer.
  3. Microsoft Entra ID P1
  4. Microsoft Entra ID Free

Explanation

Privileged Identity Management provides eligible, time-bound role assignments with approval workflows, and it requires Microsoft Entra ID P2 (or an equivalent Entra ID Governance license). P1 does not include PIM.

Question 27Design identity, governance, and monitoring solutions

Which Azure Policy effect prevents a noncompliant resource from being created or updated?

  1. Audit
  2. Append
  3. Deny Correct answer.
  4. Modify

Explanation

The Deny effect blocks the create or update request when the resource does not meet the policy rule. Audit only records noncompliance, while Append and Modify change resource properties.

Question 28Design identity, governance, and monitoring solutions

What is the primary purpose of an Azure management group?

  1. To provide a shared storage account for subscriptions
  2. To host virtual machines in multiple regions
  3. To group subscriptions for governance Correct answer.
  4. To replace role-based access control in subscriptions

Explanation

Management groups form a hierarchy above subscriptions so that policies and role assignments can be applied consistently to many subscriptions. They are containers for governance, not compute or storage resources.

Question 29Design identity, governance, and monitoring solutions

What does an Azure Monitor action group define?

  1. The pricing tier of a Log Analytics workspace
  2. Alert notifications and automated actions Correct answer.
  3. The scope of a diagnostic setting
  4. The retention period for metric data

Explanation

An action group is a reusable collection of notification channels and automated actions, such as email, SMS, webhooks, and runbooks, that run when an alert fires. Alert rules reference action groups rather than defining recipients directly.

Question 30Design identity, governance, and monitoring solutions

Which destinations can an Azure Monitor diagnostic setting send data to?

  1. Only a Log Analytics workspace
  2. Log Analytics, storage, event hub, or partner Correct answer.
  3. Only a storage account and an event hub
  4. An Azure SQL database or a virtual network

Explanation

A diagnostic setting can route resource logs and metrics to a Log Analytics workspace, an Azure Storage account, an event hub, or a supported partner solution. Multiple destinations can be selected in one setting.

Question 31Design identity, governance, and monitoring solutions

For a system-assigned managed identity, what is the identity's lifecycle tied to?

  1. The resource group that contains the resource
  2. The Azure resource that hosts it Correct answer.
  3. The subscription billing cycle
  4. The Entra ID tenant

Explanation

A system-assigned managed identity is created with the Azure resource and is deleted automatically when that resource is deleted. Its lifetime is therefore bound to the individual resource.

Question 32Design identity, governance, and monitoring solutions

By default, how long does Azure retain Activity Log events for querying?

  1. 365 days
  2. 7 days
  3. 30 days
  4. 90 days Correct answer.

Explanation

Azure retains Activity Log events for 90 days by default. For longer retention, events can be exported to a Log Analytics workspace, a storage account, or an event hub through a diagnostic setting.

Question 33Design identity, governance, and monitoring solutions

Which built-in Azure role lets a user view all resources in a subscription but not change them?

  1. Reader Correct answer.
  2. Owner
  3. Contributor
  4. User Access Administrator

Explanation

The Reader role grants view access to resources without permission to modify them. Contributor can modify resources, while Owner and User Access Administrator can also manage access.

Question 34Design identity, governance, and monitoring solutions

Which license is the minimum required to use Conditional Access policies in Microsoft Entra ID?

  1. Microsoft Entra ID Free
  2. Microsoft Entra ID P2
  3. Microsoft Entra ID P1 Correct answer.
  4. Microsoft 365 Apps

Explanation

Conditional Access requires Microsoft Entra ID P1 or a license that includes P1 capabilities. P2 includes P1 plus additional identity governance and risk features.

Question 35Design identity, governance, and monitoring solutions

Which Azure Policy construct groups multiple policy definitions into a single assignable unit?

  1. A resource lock
  2. A custom role definition
  3. An initiative Correct answer.
  4. A management group

Explanation

A policy initiative, also called a policy set, bundles multiple policy definitions so they can be assigned and tracked as one unit. The initiative itself does not enforce anything until it is assigned to a scope.

Question 36Design identity, governance, and monitoring solutions

A policy assignment at the subscription level blocks a required configuration. A specific resource group must be allowed to use that configuration. What should you create?

  1. A policy exemption Correct answer.
  2. A new subscription
  3. A custom role
  4. A resource lock

Explanation

A policy exemption waives a policy assignment for a specific scope, such as a resource group, while leaving the assignment in place for everything else. Exemptions can be temporary and can include an expiry date.

Question 37Design identity, governance, and monitoring solutions

You need interactive queries over the last 90 days and long-term retention for seven years at the lowest cost. Which Log Analytics setting should you configure?

  1. Configure workspace retention to 2555 days for all tables
  2. Use 90-day interactive retention and seven-year total retention Correct answer.
  3. Use 730-day workspace retention and a heartbeat query
  4. Export logs to a storage account and query them with Azure Search

Explanation

Log Analytics separates interactive retention, which keeps data queryable with KQL, from total retention, which can extend data into long-term retention at a lower cost. Setting 90 days interactive and seven years total meets both requirements economically.

Question 38Design identity, governance, and monitoring solutions

During a planned maintenance window, you need to stop action groups from firing without disabling the alert rules. What should you use?

  1. An alert processing rule Correct answer.
  2. A diagnostic setting
  3. A data collection rule
  4. A resource lock

Explanation

Alert processing rules can suppress notifications and actions for a selected scope during a defined time window, while the underlying alert rules remain enabled. This is the supported way to mute alerts temporarily.

Question 39Design identity, governance, and monitoring solutions

Which metric alert setting adapts to daily or weekly patterns and reduces false positives from expected spikes?

  1. Dimension splitting
  2. Dynamic thresholds Correct answer.
  3. Evaluation frequency
  4. Static threshold

Explanation

Dynamic thresholds use machine learning to establish a baseline that follows recurring patterns and then alert when behavior deviates from that baseline. Static thresholds require a fixed value that may not fit changing workloads.

Question 40Design identity, governance, and monitoring solutions

An Application Insights workload produces too much telemetry. You need to reduce volume while keeping a representative sample of traces. What should you enable?

  1. Availability tests
  2. Continuous export
  3. Live metrics
  4. Sampling Correct answer.

Explanation

Sampling reduces the number of telemetry items stored while preserving statistically representative traces, which lowers ingestion cost. It is configured in Application Insights and can be adapted to the application's traffic patterns.

Question 41Design identity, governance, and monitoring solutions

You must collect Windows event logs from many Azure virtual machines and control which events are collected centrally. What should you deploy?

  1. The legacy Log Analytics agent
  2. Azure Monitor Agent plus a collection rule Correct answer.
  3. Application Insights with availability tests
  4. A diagnostic setting on each virtual machine

Explanation

The Azure Monitor Agent uses data collection rules to define which events and performance counters are collected and where the data is sent. This provides centralized, scalable control over VM telemetry.

Question 42Design identity, governance, and monitoring solutions

Several virtual machines must share the same managed identity that survives VM rebuilds. Which identity type should you use?

  1. A service principal with a client secret
  2. A shared Key Vault access policy
  3. A system-assigned managed identity
  4. A user-assigned managed identity Correct answer.

Explanation

A user-assigned managed identity is a standalone Azure resource that can be attached to multiple virtual machines and persists independently of any single VM. A system-assigned identity is deleted with its host resource.

Question 43Design identity, governance, and monitoring solutions

A company wants to synchronize on-premises Active Directory users to Microsoft Entra ID without deploying any on-premises sync servers. Which service should it use?

  1. Microsoft Entra Domain Services
  2. Active Directory Federation Services
  3. Microsoft Entra Connect
  4. Microsoft Entra Cloud Sync Correct answer.

Explanation

Microsoft Entra Cloud Sync uses lightweight agents managed from the cloud and does not require a dedicated on-premises sync server. Microsoft Entra Connect requires a server-based synchronization engine.

Question 44Design identity, governance, and monitoring solutions

You need to receive an email when Azure spending in a subscription exceeds 80 percent of a monthly target. What should you configure?

  1. A budget with an alert Correct answer.
  2. An Azure Advisor recommendation
  3. A resource lock
  4. A cost allocation tag

Explanation

Azure Cost Management budgets track spending against a target amount and can trigger alerts when a threshold is reached. Budget alerts notify stakeholders but do not stop resource usage.

Question 45Design identity, governance, and monitoring solutions

An application must read secrets from Key Vault by using Microsoft Entra ID, and the vault uses the Azure RBAC permission model. Which role provides read-only access to secrets?

  1. Key Vault Reader
  2. Key Vault Contributor
  3. Key Vault Secrets Officer
  4. Key Vault Secrets User Correct answer.

Explanation

Key Vault Secrets User can read secret contents, which is the least-privileged built-in role for an application that only retrieves secrets. Key Vault Reader can see vault metadata but not secret values.

Question 46Design identity, governance, and monitoring solutions

A company wants new users in its tenant to be created automatically from a partner tenant for collaboration. Which feature should it use?

  1. Cross-tenant synchronization Correct answer.
  2. Conditional Access
  3. Access reviews
  4. B2B redemption with email one-time passcode

Explanation

Cross-tenant synchronization automatically creates and maintains users in the target tenant based on users from a partner tenant. It is designed for seamless collaboration without manual B2B invitation redemption.

Question 47Design identity, governance, and monitoring solutions

Which Azure Policy effect evaluates whether a related resource, such as a diagnostic setting, exists and reports compliance without blocking deployment?

  1. Append
  2. DeployIfNotExists
  3. Deny
  4. AuditIfNotExists Correct answer.

Explanation

AuditIfNotExists checks for the existence of a related resource and records noncompliance when that resource is missing. It does not block deployment and does not create the missing resource.

Question 48Design identity, governance, and monitoring solutions

Users in a shared Log Analytics workspace must see only logs for resources they own. Which access model should you use?

  1. A shared workspace key
  2. Workspace-context access with the Log Analytics Reader role
  3. A custom role with the */read action
  4. Resource-context access Correct answer.

Explanation

Resource-context access lets users query data for resources they already have permissions on, without granting access to the entire workspace. It is the recommended model for shared workspaces when data isolation is required.

Question 49Design identity, governance, and monitoring solutions

A pod in Azure Kubernetes Service must access Key Vault without storing secrets. Which mechanism should you use?

  1. A Key Vault access policy for all nodes
  2. A service principal secret in a Kubernetes secret
  3. Workload identity federation Correct answer.
  4. A system-assigned identity on the cluster nodes

Explanation

Microsoft Entra Workload ID uses federated credentials to let a Kubernetes service account obtain tokens and access Azure resources without stored secrets. This avoids sharing node identities across all pods.

Question 50Design identity, governance, and monitoring solutions

One metric alert must monitor CPU for 50 virtual machines separately. What should you configure?

  1. 50 separate alert rules
  2. Dimension splitting on the VM name Correct answer.
  3. An action group per virtual machine
  4. A single static threshold without dimensions

Explanation

Dimension splitting creates a separate time series for each value of a dimension, so a single metric alert rule can evaluate and alert on each VM independently. This reduces rule sprawl compared with one rule per VM.