Microsoft AZ-305 QUESTIONS AND ANSWERS |
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
Domain 1: Design Identity, Governance, and Monitoring Solutions (25 Questions)
1. A company needs to ensure that all Azure resources are deployed only to approved regions. What should you
implement?
- A) Azure Policy with a deny effect
,- B) Role-Based Access Control (RBAC)
- C) Resource locks
- D) Management groups
Answer: A
Rationale: Azure Policy with a "deny" effect can restrict resource deployments to specific regions. RBAC controls
who can do actions, not where. Resource locks prevent deletion/modification. Management groups organize
subscriptions but don't restrict regions by themselves.
2. Which Azure AD feature allows conditional access based on device compliance?
- A) Azure AD Connect
- B) Conditional Access policies
- C) Privileged Identity Management
- D) Entra ID Protection
Answer: B
Rationale: Conditional Access policies evaluate signals (user, device, location, app) and enforce access
controls, including requiring compliant devices. The other options serve different purposes.
,3. A company wants just-in-time privileged access to Azure resources with approval workflows. What should you
use?
- A) Azure RBAC
- B) Azure AD Privileged Identity Management (PIM)
- C) Conditional Access
- D) Azure Key Vault
Answer: B
Rationale: PIM provides time-bound, approval-based activation of privileged roles. RBAC alone is always-on.
Conditional Access is about access decisions, not role activation.
4. Which tool should you use to enforce naming conventions on Azure resources?
- A) Azure Policy
- B) Resource tags
- C) Azure Blueprints
- D) Management groups
Answer: A
, Rationale: Azure Policy can enforce naming conventions using the "deny" effect with a naming pattern rule. Tags
are metadata, not enforcement. Blueprints package artifacts but naming enforcement is best done with Policy.
5. A company requires that all data leaving a storage account be logged and auditable. What should you
enable?
- A) Azure Monitor metrics
- B) Storage analytics logging / diagnostic settings
- C) Azure Advisor
- D) Network Watcher
Answer: B
Rationale: Diagnostic settings on storage accounts capture read/write/delete operations to Log Analytics or
storage. Metrics are numeric. Advisor gives recommendations. Network Watcher is for network diagnostics.
6. Which Azure AD feature supports passwordless authentication using a phone app?
- A) Azure AD Connect
- B) Microsoft Authenticator
- C) Conditional Access
- D) SSPR
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
Domain 1: Design Identity, Governance, and Monitoring Solutions (25 Questions)
1. A company needs to ensure that all Azure resources are deployed only to approved regions. What should you
implement?
- A) Azure Policy with a deny effect
,- B) Role-Based Access Control (RBAC)
- C) Resource locks
- D) Management groups
Answer: A
Rationale: Azure Policy with a "deny" effect can restrict resource deployments to specific regions. RBAC controls
who can do actions, not where. Resource locks prevent deletion/modification. Management groups organize
subscriptions but don't restrict regions by themselves.
2. Which Azure AD feature allows conditional access based on device compliance?
- A) Azure AD Connect
- B) Conditional Access policies
- C) Privileged Identity Management
- D) Entra ID Protection
Answer: B
Rationale: Conditional Access policies evaluate signals (user, device, location, app) and enforce access
controls, including requiring compliant devices. The other options serve different purposes.
,3. A company wants just-in-time privileged access to Azure resources with approval workflows. What should you
use?
- A) Azure RBAC
- B) Azure AD Privileged Identity Management (PIM)
- C) Conditional Access
- D) Azure Key Vault
Answer: B
Rationale: PIM provides time-bound, approval-based activation of privileged roles. RBAC alone is always-on.
Conditional Access is about access decisions, not role activation.
4. Which tool should you use to enforce naming conventions on Azure resources?
- A) Azure Policy
- B) Resource tags
- C) Azure Blueprints
- D) Management groups
Answer: A
, Rationale: Azure Policy can enforce naming conventions using the "deny" effect with a naming pattern rule. Tags
are metadata, not enforcement. Blueprints package artifacts but naming enforcement is best done with Policy.
5. A company requires that all data leaving a storage account be logged and auditable. What should you
enable?
- A) Azure Monitor metrics
- B) Storage analytics logging / diagnostic settings
- C) Azure Advisor
- D) Network Watcher
Answer: B
Rationale: Diagnostic settings on storage accounts capture read/write/delete operations to Log Analytics or
storage. Metrics are numeric. Advisor gives recommendations. Network Watcher is for network diagnostics.
6. Which Azure AD feature supports passwordless authentication using a phone app?
- A) Azure AD Connect
- B) Microsoft Authenticator
- C) Conditional Access
- D) SSPR
