AZ-305 practice questions
AZ-305 Questions 61-70: Security, Governance, and Monitoring Design
Use this AZ-305 questions 61-70 practice set to review identity, governance, security, and monitoring design decisions for the Microsoft Azure Solutions Architect Expert exam. The questions are original, scenario-based, and aligned to public AZ-305 objective areas — no exam dumps, no recycled proprietary items.
AZ-305 Designing Microsoft Azure Infrastructure Solutions
Questions 61-70
Design identity, governance, and monitoring solutions
Architect-level design scenarios
AZ-305 questions 61-70
Question 61 Governance scope
Designing policy and RBAC inheritance across multiple subscriptions
A company has 24 Azure subscriptions across production, non-production, and shared services. The security team wants baseline policies and role assignments to apply consistently, while application teams still need delegated control inside their own subscriptions. You need to recommend the most scalable governance design.
Choose one answer.
- Create a management group hierarchy for the environment types, assign Azure Policy initiatives and RBAC at the appropriate management group scopes, and place subscriptions under the correct management groups.
- Create identical Azure Policy assignments separately in each subscription and ask each application team to maintain its own RBAC assignments.
- Create one resource group in each subscription named Governance and assign all policies and roles to that resource group.
- Move all production resources into a single subscription so governance can be applied at one subscription scope.
Explanation: Management groups provide a hierarchy above subscriptions, which makes them the right design point for repeatable enterprise governance. You can assign Azure Policy initiatives and Azure RBAC roles at management group scope so subscriptions inherit the intended controls.
Why the other options are wrong: B creates operational drift and repeated effort. C scopes governance too low; resource group assignments do not cover subscription-wide resources or future resource groups. D reduces flexibility and does not reflect common enterprise segmentation patterns.
Objective/domain: Design identity, governance, and monitoring solutions.
Question 62 Privileged access
Reducing standing administrator permissions
An operations group occasionally needs Owner permissions on a production subscription to perform emergency changes. Compliance requires approval, MFA, time-limited elevation, and audit evidence. The group should not retain permanent Owner access.
Choose one answer.
- Assign the group the permanent Owner role and use Azure Activity Log alerts to detect changes.
- Configure Microsoft Entra Privileged Identity Management with eligible Azure resource role assignments, approval, MFA, and activation duration settings.
- Create a shared emergency administrator account and store the password in a secured document repository.
- Assign the group Contributor access and add a resource lock to production resource groups.
Explanation: Microsoft Entra Privileged Identity Management (PIM) is designed for just-in-time privileged access. It supports eligible assignments, activation controls such as MFA and approval, limited activation windows, and auditability.
Why the other options are wrong: A leaves excessive standing privilege in place. C weakens accountability and creates a shared credential risk. D does not grant the required emergency Owner capabilities and resource locks are not a privileged-access control.
Objective/domain: Design identity, governance, and monitoring solutions.
Question 63 Policy remediation
Enforcing cost allocation tags at scale
A finance team requires every Azure resource to have a CostCenter tag. Existing resources without the tag should be remediated where possible, and new resources should automatically receive the tag value inherited from the parent resource group when teams forget to provide it.
Choose one answer.
- Use Azure Policy with a
modifyeffect, assign it at the appropriate management group or subscription scope, configure the managed identity, and run remediation tasks for existing resources. - Use Microsoft Cost Management budgets and configure email alerts for resources that do not have a
CostCentertag. - Use Azure Resource Graph queries manually each month and ask resource owners to update missing tags.
- Use a CanNotDelete resource lock on each resource group until teams add the tag manually.
Explanation: Azure Policy can enforce organizational standards and remediate noncompliant resources. A modify policy is commonly used for tag inheritance or tag correction scenarios when paired with a managed identity and remediation.
Why the other options are wrong: B helps with cost visibility but does not enforce or remediate tags. C detects drift but does not automatically correct it. D prevents deletion but does not add or enforce metadata.
Objective/domain: Design identity, governance, and monitoring solutions.
Question 64 Monitoring architecture
Centralizing operational queries and alerting
A company needs a central place to query Azure resource logs, create log-based alerts, and correlate telemetry from multiple subscriptions. The operations team uses KQL and wants to retain interactive troubleshooting data for 180 days.
Choose one answer.
- Configure diagnostic settings to send resource logs to a Log Analytics workspace and create Azure Monitor alerts from queries.
- Configure diagnostic settings to archive all logs only to an Azure Storage account.
- Configure diagnostic settings to send logs only to an Event Hubs namespace.
- Use Azure Service Health alerts only, because they contain resource-level diagnostic logs.
Explanation: Azure Monitor with Log Analytics supports centralized log collection, KQL queries, workbooks, and alert rules. Diagnostic settings route platform logs and metrics to destinations such as Log Analytics, Storage, and Event Hubs; Log Analytics is the best match for query-driven operations.
Why the other options are wrong: B is useful for low-cost archive but not interactive KQL analysis. C is useful for streaming to external systems but not the simplest native query workspace. D monitors Azure service incidents and health events, not detailed resource diagnostic logs.
Objective/domain: Design identity, governance, and monitoring solutions.
Question 65 Security posture
Designing a cloud security posture management approach
An enterprise runs workloads in Azure, AWS, and on-premises. Security leadership wants a single service to assess cloud security posture, surface recommendations, and enable workload protection plans for supported resource types. The solution should align with Microsoft security tooling.
Choose one answer.
- Use Microsoft Defender for Cloud and onboard Azure subscriptions, supported multicloud accounts, and applicable servers through the supported connectors or agents.
- Use Azure Advisor only, because it provides all cloud workload protection capabilities across Azure, AWS, and on-premises environments.
- Use Azure Policy only, because it replaces threat detection and workload protection features.
- Use Microsoft Entra Conditional Access only, because it evaluates infrastructure security posture across all clouds.
Explanation: Microsoft Defender for Cloud provides cloud security posture management and workload protection capabilities across Azure and supported hybrid or multicloud environments. It is the best fit when the requirement includes posture recommendations plus protection plans.
Why the other options are wrong: B offers operational recommendations but is not a full CNAPP/CWPP platform. C helps enforce compliance but does not replace Defender threat protection. D controls identity-based access decisions; it is not a workload posture management solution.
Objective/domain: Design security and monitoring solutions.
Question 66 Conditional Access
Protecting administrator sign-ins
A company wants to require MFA for users assigned administrative roles when they sign in from outside trusted corporate locations. It also wants to block legacy authentication for those administrators. The solution should be identity-based and centrally managed.
Choose one answer.
- Create Microsoft Entra Conditional Access policies targeting administrative roles, requiring MFA from untrusted locations and blocking legacy authentication.
- Create Azure Network Security Groups that deny traffic from non-corporate IP ranges to the Azure portal.
- Assign administrators the Reader role until they connect through the corporate VPN.
- Create Azure Policy assignments that audit sign-ins from unknown locations.
Explanation: Conditional Access is the Microsoft Entra control plane for evaluating sign-in signals such as user, role, location, client app, risk, and authentication strength. It is the right design choice for MFA requirements and blocking legacy authentication.
Why the other options are wrong: B does not control access to Microsoft Entra sign-ins or the Azure portal in the required way. C breaks administration without implementing conditional identity controls. D Azure Policy governs Azure resources, not interactive sign-in conditions.
Objective/domain: Design identity and access solutions.
Question 67 Secrets and identity
Allowing an application to read secrets without embedded credentials
An App Service web app needs to retrieve a database connection secret from Azure Key Vault. Security requirements state that no client secret, certificate file, or password can be stored in application settings or source code. Access must be revocable and auditable.
Choose one answer.
- Enable a managed identity for the web app and grant it the minimum required Key Vault permissions by using Azure RBAC or a Key Vault access policy.
- Create an app registration, generate a client secret, and place the secret in the web app configuration.
- Export the Key Vault secret to an encrypted JSON file and deploy it with the application package.
- Grant all developers Key Vault Administrator so the application can read the secret through their credentials.
Explanation: Managed identities provide an automatically managed identity in Microsoft Entra ID for supported Azure resources. The application can request tokens without storing credentials, and Key Vault permissions can be granted using least privilege.
Why the other options are wrong: B still stores a credential. C creates secret sprawl outside Key Vault. D grants excessive human privilege and does not represent application identity.
Objective/domain: Design identity and secure access solutions.
Question 68 Audit retention
Designing control-plane log retention
A regulated organization must retain Azure subscription control-plane activity logs for seven years. Security analysts also need to query recent activity interactively for investigations and alerts. The design should balance long-term retention cost with operational query capability.
Choose one answer.
- Configure diagnostic settings for the subscription Activity Log to send data to Log Analytics for operational analysis and to a Storage account with lifecycle management for long-term retention.
- Rely on the default Activity Log retention only and export logs manually during audits.
- Send Activity Logs only to Event Hubs and do not retain a copy in Azure.
- Create an Azure Monitor metric alert for all administrative operations and delete the underlying log data after 30 days.
Explanation: Diagnostic settings can route platform logs to multiple destinations. Log Analytics is suitable for recent investigation and alerting, while Storage is a common low-cost long-term archive target when compliance requires multi-year retention.
Why the other options are wrong: B does not meet seven-year retention. C may support streaming to another SIEM but does not satisfy the stated Azure-retained query and archive needs by itself. D keeps alert signals but discards the evidence needed for audits and investigations.
Objective/domain: Design monitoring solutions.
Question 69 Resource protection
Preventing accidental deletion of critical resources
A platform team hosts shared DNS zones, route tables, and monitoring resources in a production resource group. Administrators with Contributor access must be able to update configurations, but the organization wants to reduce the risk of accidental deletion of the resource group or its resources.
Choose one answer.
- Apply a CanNotDelete resource lock at the resource group scope and document the break-glass process for authorized lock removal.
- Apply a ReadOnly resource lock at the subscription scope so administrators can continue updating production resources.
- Use Azure Policy to automatically delete resources that do not meet naming standards.
- Move the resources to a different Azure region to protect them from deletion.
Explanation: A CanNotDelete lock helps prevent accidental deletion while still allowing permitted update operations. Applying it at resource group scope protects the contained resources and the group itself, while allowing a controlled removal process when deletion is genuinely required.
Why the other options are wrong: B would block write operations, not just deletes, and subscription scope is broader than required. C is unrelated and destructive. D does not change authorization or deletion behavior.
Objective/domain: Design governance solutions.
Question 70 Network security design
Centralizing outbound inspection for spoke virtual networks
An organization uses a hub-and-spoke network topology. Application teams deploy workloads into separate spoke virtual networks. Security requires centrally managed outbound filtering, threat intelligence-based rules, and consistent egress logging without deploying a firewall appliance in every spoke.
Choose one answer.
- Deploy Azure Firewall in the hub virtual network, configure route tables in the spokes to send outbound traffic through the firewall, and manage rules centrally with Azure Firewall Policy.
- Deploy a separate Azure Firewall in every spoke virtual network and allow each application team to manage its own firewall rules independently.
- Use Network Security Groups only, because NSGs provide fully centralized layer 7 outbound filtering and threat intelligence rules.
- Disable internet access for all spoke subnets and require administrators to manually copy updates into each virtual machine.
Explanation: In a hub-and-spoke design, Azure Firewall commonly provides centralized traffic inspection and policy enforcement from the hub. User-defined routes can send spoke egress traffic to the firewall, and Azure Firewall Policy supports centralized rule management.
Why the other options are wrong: B increases cost and creates inconsistent management. C NSGs are valuable for network-layer filtering but do not provide the same centralized firewall policy and threat intelligence features. D is operationally unrealistic and does not meet the stated managed egress requirement.
Objective/domain: Design infrastructure and security solutions.
Answer key summary
| Question | Answer | Key idea |
|---|---|---|
| 61 | A | Management groups for inherited governance |
| 62 | B | PIM for just-in-time privileged roles |
| 63 | A | Azure Policy modify effect and remediation |
| 64 | A | Log Analytics for KQL and alerts |
| 65 | A | Defender for Cloud for CSPM/CWPP |
| 66 | A | Conditional Access for admin sign-in controls |
| 67 | A | Managed identity for Key Vault access |
| 68 | A | Diagnostic settings to Log Analytics and Storage |
| 69 | A | CanNotDelete lock for accidental deletion protection |
| 70 | A | Hub Azure Firewall for centralized egress control |
Sources
- Microsoft Learn: Exam AZ-305: Designing Microsoft Azure Infrastructure Solutions
- Microsoft Learn: Organize your resources with Azure management groups
- Microsoft Learn: Overview of Azure Policy
- Microsoft Learn: Define your tagging strategy
- Microsoft Learn: What is Privileged Identity Management?
- Microsoft Learn: Azure Monitor overview
- Microsoft Learn: Diagnostic settings in Azure Monitor
- Microsoft Learn: Microsoft Defender for Cloud overview
- Microsoft Learn: Azure Well-Architected Framework security design principles
- Microsoft Learn: What is Conditional Access?
- Microsoft Learn: Managed identities for App Service
- Microsoft Learn: Lock your resources to protect your infrastructure
- Microsoft Learn: What is Azure Firewall?
