Microsoft AZ-305 Practice Test 8
Question 70
A security team needs auditable actions after a critical monitor alert without embedding scripts in alert rules. Which Azure architecture choice best meets this requirement?
- Keep all telemetry in high-cost interactive workspace hot tables indefinitely.
- Connect an action group to an authorized automation workflow or ITSM endpoint.
- Give every alert rule the subscription Owner role as its remediation mechanism.
- Delete the native workspace and rely on SIEM ingestion as an Azure alerting solution.
Explanation
Correct Answer
B:Central actions separate alert condition evaluation from approved response execution.
Incorrect Answers
A:Long hot retention incurs unnecessary analytics costs for seldom accessed records. In the present requirement, a security team needs auditable actions after a critical monitor alert without embedding scripts in alert rules. The needed design instead works because central actions separate alert condition evaluation from approved response execution.
C:Broad role grants are unrelated to safe event-triggered execution. This proposal contradicts the stated architecture constraint.
D:The external destination alone does not provide native KQL investigations. In the present requirement, a security team needs auditable actions after a critical monitor alert without embedding scripts in alert rules. The needed design instead works because central actions separate alert condition evaluation from approved response execution.
Question 71
An architecture proposal for long-term logs and external operations relies on the following approach: Give every alert rule the subscription Owner role as its remediation mechanism. Which specific failure or mismatch should the design reviewer identify?
- Broad role grants are unrelated to safe event-triggered execution.
- CPU metrics do not contain exception message text needed by the detection.
- Long hot retention incurs unnecessary analytics costs for seldom accessed records.
- The external destination alone does not provide native KQL investigations.
Explanation
Correct Answer
A:Give every alert rule the subscription Owner role as its remediation mechanism. Broad role grants are unrelated to safe event-triggered execution.
Incorrect Answers
B:This concern applies to Configure a static VM CPU metric threshold for an HTTP exception string. in another design solutions for logging and monitoring design. The current proposal specifically fails because broad role grants are unrelated to safe event-triggered execution.
C:That assessment refers to the separate proposal 'Keep all telemetry in high-cost interactive workspace hot tables indefinitely.' not to the recommendation under review. Here, Broad role grants are unrelated to safe event-triggered execution.
D:That assessment refers to the separate proposal 'Delete the native workspace and rely on SIEM ingestion as an Azure alerting solution.' not to the recommendation under review. Here, Broad role grants are unrelated to safe event-triggered execution.
Question 72
Acceptance testing must establish the following operational result: Recorded executions show the authorized action received the correct event. Which verification action most directly establishes that outcome?
- Compare a generated source event in both the stream consumer and Log Analytics.
- Generate test exceptions and confirm the log alert fires after ingestion.
- Retrieve archived logs from a historical period and check retention settings.
- Run a nonproduction test alert and inspect automation run history.
Explanation
Correct Answer
D:Recorded executions show the authorized action received the correct event.
Incorrect Answers
A:That verification addresses the different requirement: An external SIEM must receive operational events while Azure teams continue using Log Analytics. It does not directly establish recorded executions show the authorized action received the correct event.
B:This is a test for A NOC must alert when a specific HTTP exception appears more than five times in ten minutes. The requirement here is instead demonstrated by run a nonproduction test alert and inspect automation run history.
C:That verification addresses the different requirement: Finance requires cheap retention of raw diagnostics for seven years with infrequent retrieval. It does not directly establish recorded executions show the authorized action received the correct event.
Question 73
A hybrid enterprise moves from AD FS to managed Microsoft Entra sign-in while retaining its AD DS user source. Which TWO controls support a safe transition? (Select TWO.)
- Confirm directory synchronization and sign-in during a controlled federation-unavailable test.
- Replace every synchronized user with an untracked local guest account.
- Stage supported password-hash-synchronized or pass-through authentication for a limited pilot.
- Delete the federation service before any users are validated.
- Publish AD DS authentication ports anonymously to the internet.
Explanation
Correct Answers
A:The check validates that users no longer rely on the old federation endpoint.
C:A pilot validates the managed sign-in path before global change.
Incorrect Answers
B:It breaks source-of-authority and identity lifecycle controls.
D:Immediate removal threatens users not yet migrated.
E:Public exposure is unnecessary and unsafe for the managed transition.
Question 74
An architecture proposal for hybrid workforce sign-in relies on the following approach: Require an on-premises federation service for every cloud login despite a cloud-resilience goal. Which specific failure or mismatch should the design reviewer identify?
- Authoritative on-premises values can overwrite unsupported cloud-only edits.
- Federation introduces a dependency on reachable on-premises identity infrastructure.
- Manual batch processing lacks reliable identity matching and lifecycle reconciliation.
- Irreversible purge defeats recovery safeguards.
Explanation
Correct Answer
B:Require an on-premises federation service for every cloud login despite a cloud-resilience goal. Federation introduces a dependency on reachable on-premises identity infrastructure.
Incorrect Answers
A:That assessment refers to the separate proposal 'Override the on-premises sourced attribute in cloud and assume it will persist.' not to the recommendation under review. Here, Federation introduces a dependency on reachable on-premises identity infrastructure.
C:That assessment refers to the separate proposal 'Merge all source accounts manually into one spreadsheet each night.' not to the recommendation under review. Here, Federation introduces a dependency on reachable on-premises identity infrastructure.
D:This concern applies to Grant ordinary application operators unrestricted immediate purge permission. in another design authentication and authorization solutions design. The current proposal specifically fails because federation introduces a dependency on reachable on-premises identity infrastructure.
Question 75
Acceptance testing must establish the following operational result: Successful cloud authentication establishes independence from on-premises federation availability. Which verification action most directly establishes that outcome?
- Test sign-in during an approved on-premises identity-service outage simulation.
- Run an authorized recovery test in a nonproduction vault.
- Review sync run and connector error logs for the affected object.
- Compare representative users and excluded objects after the sync cycle.
Explanation
Correct Answer
A:Successful cloud authentication establishes independence from on-premises federation availability.
Incorrect Answers
B:This is a test for A critical vault must withstand operator mistakes including accidental key deletion. The requirement here is instead demonstrated by test sign-in during an approved on-premises identity-service outage simulation.
C:That verification addresses the different requirement: A synced employee is renamed on-premises but still appears with stale cloud identity attributes. It does not directly establish successful cloud authentication establishes independence from on-premises federation availability.
D:That verification addresses the different requirement: An enterprise requires cloud-managed user provisioning from several AD forests with supported object filtering. It does not directly establish successful cloud authentication establishes independence from on-premises federation availability.
Question 76
An enterprise requires cloud-managed user provisioning from several AD forests with supported object filtering. Which Azure architecture choice best meets this requirement?
- Override the on-premises sourced attribute in cloud and assume it will persist.
- Require an on-premises federation service for every cloud login despite a cloud-resilience goal.
- Evaluate Microsoft Entra Cloud Sync topology and filtering support against forest requirements.
- Merge all source accounts manually into one spreadsheet each night.
Explanation
Correct Answer
C:Agent-based synchronization can support selected multi-forest provisioning scenarios.
Incorrect Answers
A:Authoritative on-premises values can overwrite unsupported cloud-only edits. In the present requirement, an enterprise requires cloud-managed user provisioning from several AD forests with supported object filtering. The needed design instead works because agent-based synchronization can support selected multi-forest provisioning scenarios.
B:Federation introduces a dependency on reachable on-premises identity infrastructure. In the present requirement, an enterprise requires cloud-managed user provisioning from several AD forests with supported object filtering. The needed design instead works because agent-based synchronization can support selected multi-forest provisioning scenarios.
D:Manual batch processing lacks reliable identity matching and lifecycle reconciliation. This proposal contradicts the stated architecture constraint.
Question 77
An architecture proposal for hybrid workforce sign-in relies on the following approach: Merge all source accounts manually into one spreadsheet each night. Which specific failure or mismatch should the design reviewer identify?
- Authoritative on-premises values can overwrite unsupported cloud-only edits.
- Public unauthenticated exposure violates the controlled access requirement.
- Manual batch processing lacks reliable identity matching and lifecycle reconciliation.
- Federation introduces a dependency on reachable on-premises identity infrastructure.
Explanation
Correct Answer
C:Merge all source accounts manually into one spreadsheet each night. Manual batch processing lacks reliable identity matching and lifecycle reconciliation.
Incorrect Answers
A:That assessment refers to the separate proposal 'Override the on-premises sourced attribute in cloud and assume it will persist.' not to the recommendation under review. Here, Manual batch processing lacks reliable identity matching and lifecycle reconciliation.
B:This concern applies to Publish the app directly on public HTTP with no identity preauthentication. in another design authentication and authorization solutions design. The current proposal specifically fails because manual batch processing lacks reliable identity matching and lifecycle reconciliation.
D:That assessment refers to the separate proposal 'Require an on-premises federation service for every cloud login despite a cloud-resilience goal.' not to the recommendation under review. Here, Manual batch processing lacks reliable identity matching and lifecycle reconciliation.
Question 78
Acceptance testing must establish the following operational result: Correct scoping proves the selected directory attributes and objects were reconciled. Which verification action most directly establishes that outcome?
- Test sign-in during an approved on-premises identity-service outage simulation.
- Review sync run and connector error logs for the affected object.
- Compare representative users and excluded objects after the sync cycle.
- Attempt sign-in with assigned and unassigned test users through the published URL.
Explanation
Correct Answer
C:Correct scoping proves the selected directory attributes and objects were reconciled.
Incorrect Answers
A:That verification addresses the different requirement: A legacy company keeps AD DS identities but wants managed cloud authentication and password parity. It does not directly establish correct scoping proves the selected directory attributes and objects were reconciled.
B:That verification addresses the different requirement: A synced employee is renamed on-premises but still appears with stale cloud identity attributes. It does not directly establish correct scoping proves the selected directory attributes and objects were reconciled.
D:This is a test for Remote employees need SSO to an on-premises web app without opening inbound firewall ports. The requirement here is instead demonstrated by compare representative users and excluded objects after the sync cycle.
Question 79
A synced employee is renamed on-premises but still appears with stale cloud identity attributes. Which Azure architecture choice best meets this requirement?
- Require an on-premises federation service for every cloud login despite a cloud-resilience goal.
- Merge all source accounts manually into one spreadsheet each night.
- Diagnose the directory synchronization source-of-authority and export errors.
- Override the on-premises sourced attribute in cloud and assume it will persist.
Explanation
Correct Answer
C:Hybrid source attributes must flow through the configured synchronization pipeline.
Incorrect Answers
A:Federation introduces a dependency on reachable on-premises identity infrastructure. In the present requirement, a synced employee is renamed on-premises but still appears with stale cloud identity attributes. The needed design instead works because hybrid source attributes must flow through the configured synchronization pipeline.
B:Manual batch processing lacks reliable identity matching and lifecycle reconciliation. In the present requirement, a synced employee is renamed on-premises but still appears with stale cloud identity attributes. The needed design instead works because hybrid source attributes must flow through the configured synchronization pipeline.
D:Authoritative on-premises values can overwrite unsupported cloud-only edits. This proposal contradicts the stated architecture constraint.
Question 80
An architecture proposal for hybrid workforce sign-in relies on the following approach: Override the on-premises sourced attribute in cloud and assume it will persist. Which specific failure or mismatch should the design reviewer identify?
- Authoritative on-premises values can overwrite unsupported cloud-only edits.
- Manual batch processing lacks reliable identity matching and lifecycle reconciliation.
- Federation introduces a dependency on reachable on-premises identity infrastructure.
- Agent loss could interrupt authentication when no other method is available.
Explanation
Correct Answer
A:Override the on-premises sourced attribute in cloud and assume it will persist. Authoritative on-premises values can overwrite unsupported cloud-only edits.
Incorrect Answers
B:That assessment refers to the separate proposal 'Merge all source accounts manually into one spreadsheet each night.' not to the recommendation under review. Here, Authoritative on-premises values can overwrite unsupported cloud-only edits.
C:That assessment refers to the separate proposal 'Require an on-premises federation service for every cloud login despite a cloud-resilience goal.' not to the recommendation under review. Here, Authoritative on-premises values can overwrite unsupported cloud-only edits.
D:This concern applies to Install one agent on a single nonredundant workstation. in another design authentication and authorization solutions design. The current proposal specifically fails because authoritative on-premises values can overwrite unsupported cloud-only edits.