AZ-305 Practice Test

Sample AZ-305 Practice Questions

10 real questions from the free AZ-305bank. Pick an answer in your head, then open “Show answer” for the explanation.

1. 1. A company wants unified health monitoring across 5 Azure subscriptions and 3 on-premises sites. They need: automated alerting when any component degrades, root-cause analysis by correlating telemetry across tiers, and a single operational view - at the lowest operational complexity. Which architecture achieves this?

   • A. Deploy a separate Log Analytics workspace per subscription and per on-premises site (8 total); use cross-workspace KQL queries for the unified operational view and create alert rules in each workspace independently
   • B. Use Azure Service Health for Azure resource events, Azure Advisor for operational recommendations, and on-premises System Center Operations Manager (SCOM) for on-premises monitoring with no Azure Monitor integration
   • C. Deploy Microsoft Sentinel as the unified monitoring platform for the Azure subscriptions and on-premises sites, connecting them via Sentinel data connectors and using Sentinel workbooks for operational dashboards
   • D. Configure a centralized Log Analytics workspace, enable Diagnostic Settings on all Azure resources across all 5 subscriptions to send logs and metrics, deploy Azure Monitor Agent on on-premises servers
   Show answer

   Correct answer: D

   A centralized Log Analytics workspace with Azure Monitor provides the required capability at the lowest operational complexity: Diagnostic Settings route all Azure resource telemetry to a single workspace; Azure Monitor Agent extends collection to on-premises servers; and a single workspace enables cross-subscription correlated KQL queries, alert rules, and Azure Monitor Workbooks. Per-subscription workspaces (A) multiply management overhead and complicate cross-tier root-cause analysis. Azure Service Health and Advisor (B) provide recommendations and planned maintenance notices, not full telemetry monitoring or alerting. Microsoft Sentinel (C) is a cloud-native SIEM optimized for security analytics - it adds cost and complexity compared to Azure Monitor for operational health use cases.

2. 2. A company has 3 business units with separate compliance requirements mandating log isolation. The security team needs a centralized view of security events from all business units. Cost must be minimized. What Log Analytics workspace topology do you recommend?

   • A. Deploy a single Log Analytics workspace for the business units and the log types; use resource-context access mode so each BU's users see exclusively their own resources' logs while the security team has workspace-level Reader access for a unified security view
   • B. Deploy one Log Analytics workspace per business unit (3 total) and grant the security team Reader access to the three workspaces, using cross-workspace KQL queries to create a unified security event view across the workspaces
   • C. Deploy a single Log Analytics workspace with Microsoft Sentinel enabled, configure separate Sentinel workbooks per business unit for operational dashboards, and use Sentinel's built-in RBAC for security event isolation between teams
   • D. Deploy one operational workspace per business unit for compliance log isolation, plus a dedicated security workspace; route security events from each BU workspace to the security workspace via data collection rules - BU operational logs remain isolated while the security team's workspace provides a unified event view
   Show answer

   Correct answer: D

   Separate BU workspaces satisfy compliance isolation requirements. A dedicated security workspace receives only security events (via data collection rules or Diagnostic Settings forwarding), so the security team has a unified view without accessing BU operational logs - this avoids cross-workspace BU exposure. A single workspace with resource-context mode (A) satisfies isolation in practice but complicates compliance auditing for teams that require physical data separation. Per-BU workspaces with security team granted full Reader access to all three (B) violates isolation - the security team can see all operational logs, not just security events. Microsoft Sentinel (C) is a security-focused SIEM; it does not replace dedicated operational monitoring workspaces for each BU.

3. 3. A company with on-premises Active Directory wants to enable cloud sign-in without storing password hashes in Microsoft Entra ID and without deploying additional on-premises federation server infrastructure. Which authentication method should you recommend?

   • A. Microsoft Entra Pass-Through Authentication (PTA), which validates passwords directly against on-premises Active Directory via lightweight agents - no password hashes or credentials are stored in the cloud.
   • B. Password Hash Synchronization (PHS), which synchronizes a hashed form of user passwords to Microsoft Entra ID for cloud-based authentication
   • C. Microsoft Entra Seamless SSO with Kerberos ticket authentication, which provides single sign-on from domain-joined devices without requiring any credential synchronization to the cloud
   • D. Active Directory Federation Services (ADFS), which redirects the authentication requests to on-premises ADFS servers and WAP infrastructure for processing
   Show answer

   Correct answer: A

   Pass-Through Authentication (PTA) uses lightweight agents installed on on-premises domain members to validate passwords directly against on-premises Active Directory in real time. No password hashes are stored in Microsoft Entra ID, satisfying the cloud-storage prohibition. PTA agents are not federation servers - they require no WAP infrastructure or certificate federation configuration, satisfying the no-additional-infrastructure constraint. PHS (B) synchronizes password hashes to the cloud, violating the hash-storage requirement. Seamless SSO (C) reduces sign-in prompts for domain-joined devices but does not perform authentication itself - it complements PTA or PHS. ADFS (D) is a full federation solution requiring dedicated server infrastructure, which is explicitly excluded.

4. 4. A Microsoft Sentinel deployment needs to detect a specific attack pattern: more than 10 failed sign-in attempts followed by a successful sign-in for the same user account within a 30-minute window. What type of Sentinel analytics rule should you create?

   • A. A Scheduled analytics rule with KQL that counts failed sign-in attempts per user in a 30-minute window, joins with a successful sign-in for the same user, and alerts when the failure count exceeds 10 before the success.
   • B. A Microsoft Security Incident Creation rule that automatically promotes Microsoft Defender for Identity password spray alerts into Sentinel incidents
   • C. A Fusion analytics rule that uses built-in ML to correlate anomalous sign-in behavior with other environmental signals automatically
   • D. A Near-Real-Time (NRT) analytics rule that fires one alert per individual sign-in event and relies on Sentinel deduplication to suppress false positives
   Show answer

   Correct answer: A

   Scheduled analytics rules run KQL queries at defined intervals against ingested data. A query joining SigninLogs failure events with success events per user UPN, filtered to the 30-minute window and failure count > 10, precisely matches the described attack pattern. Scheduled rules support complex multi-event temporal correlation that other rule types cannot express. A Microsoft Security Incident Creation rule (B) promotes existing Defender for Identity alerts - it cannot define custom detection logic. Fusion rules (C) use Microsoft ML models with fixed built-in correlation patterns and do not accept custom multi-event KQL queries. NRT rules (D) are single-event triggers and cannot aggregate a count across a time window.

5. 5. An operations team wants an Azure Monitor Workbook where users select a resource group and time range from interactive controls, and all queries in the workbook automatically respond to those selections without editing the workbook definition. What workbook features should you configure?

   • A. Use Workbook Parameters - add a Resource Group picker and Time Range picker as parameters, then reference them in all KQL query expressions using the {ResourceGroup} and {TimeRange} tokens so every visualization responds dynamically to user selections.
   • B. Create separate workbook tabs, one per resource group and time period combination, with static KQL queries hard-coded to each tab - users navigate to the relevant tab for their environment and time range selection
   • C. Replace Azure Monitor Workbooks with Azure Dashboards, which support subscription-wide resource group filters applied globally across the pinned query tiles and metric charts for interactive filtering
   • D. Generate separate workbook copies from a template using an ARM deployment loop, creating one workbook per resource group and distributing them to each team's shared workspace for self-service access
   Show answer

   Correct answer: A

   Azure Monitor Workbooks support parameterization through interactive controls. Parameters of type Resource Group picker, Time range picker, Subscription picker, and others render as UI controls at the top of the workbook. KQL queries and other steps reference parameter values using the {ParameterName} syntax - Azure Monitor substitutes the selected value at query execution time. A single parameterized workbook serves all resource groups and time ranges without duplication. Static per-tab queries (B) do not respond dynamically and require manual updates for new environments. Azure Dashboards (C) support some filtering but do not support the full parameterized query model of Workbooks. Separate workbook copies per resource group (D) create maintenance overhead and do not allow cross-resource-group comparison.