Can You Answer These 5 AZ-305 Questions on Design identity, governance, and monitoring solutions?
Design identity, governance, and monitoring solutions is a recurring theme in the Azure Solutions Architect – Expert (AZ-305) exam. It makes up about 27.5% of the exam. The 5 questions below come with a full explanation of why each option is right or wrong.
Azure Solutions Architect – Expert (AZ-305) · Design identity, governance, and monitoring solutions · 5 questions with answers and explanations
🧭 What these questions look for
As an architect, you get a governance or monitoring requirement written by auditors or compliance teams: reviews in a set order, actions traced to a single app, long log retention, continuous export, or partners using their own accounts. The question asks what to recommend. Several options are technically possible, but only one meets every stated condition without extra pipelines or manual steps.
Watch for these while you work
• Choose between system-assigned and user-assigned managed identities by asking whether auditing and cleanup must follow a single resource.
• For long-term log needs, separate the period of interactive queries from the total time data must be kept. Log Analytics handles both without an export pipeline.
• When partners keep their own work accounts and your policies must still apply, look at B2B collaboration in your workforce tenant.
Question 1 of 5
Access to a finance application must be recertified twice a year. Each user's manager must review first, and then the application owner must confirm only the access the managers approved. What should you recommend?
Show answer
✅ Answer: A
Difficulty: advanced · Topic: Microsoft Entra ID Governance
Single-stage reviews
In a single-stage review, all reviewers decide within the same period and the last reviewer to decide has their decision applied. A manager could approve, and then the owner's later decision silently overrides it (or the reverse).
Multi-stage reviews
A multi-stage access review defines two or three sets of reviewers that complete the review one after another. Learn: "The stages are sequential, and the next stage doesn't happen until a decision is recorded in the previous stage." Multi-stage reviews can reduce the burden on later-stage reviewers (who can see only users approved earlier), escalate, or require independent groups to agree.
Applying it
Stage 1: managers review their direct reports' access to the finance app. Stage 2: the application owner reviews only users approved in stage 1. Recurrence is semiannual, with the recurrence at least as long as the total stage durations.
Why each option works or fails
• ✓ A. Multi-stage review (correct): stages run in order, so the owner reviews after managers and can be shown only the users they approved, matching the required two-step recertification.
• ✗ B. Re-request through an access package: this forces every user to request access again, which is not a review of existing access, and approval order in a request is not recertification.
• ✗ C. Two parallel reviews: two independent reviews run at the same time, so the owner cannot limit the review to what managers approved, and conflicting outcomes must be reconciled by hand.
• ✗ D. Single stage with both reviewers: both groups decide in the same window and the last decision wins, so there is no ordering and the owner sees every user.
Question 2 of 5
Each of 12 Azure Functions apps processes data for a different customer and needs its own permissions. Auditors want logs to show exactly which app performed each action, and permissions must disappear automatically when an app is deleted. Which identity design should you recommend?
Show answer
✅ Answer: A
Difficulty: applied · Topic: Managed identities for Azure resources, Azure Functions
Matching the identity to the resource
User-assigned identities are usually more efficient, but Learn lists two cases where system-assigned is the better fit:
• Audit logging: when you need to log which specific resource carried out an action rather than which identity, each resource needs its own identity.
• Permissions life-cycle management: a system-assigned identity, and with it the permissions granted to it, is removed when the resource is deleted.
Example
func-customer07 is deleted. Its system-assigned service principal is deleted with it, so no orphaned identity keeps rights to customer 07's storage account.
Why each option works or fails
• ✓ A. System-assigned per app (correct): each app's identity appears in its own logs and is deleted with the app, while scoping the role assignments gives each app only its own customer's resources.
• ✗ B. One shared user-assigned identity: every app could reach every customer's data, and logs show one identity for all 12 apps.
• ✗ C. Per-customer user-assigned identity: it has an independent life cycle, so deleting an app leaves the identity and its permissions behind.
• ✗ D. Service principal with certificate: it brings back credentials to rotate and does not disappear when the app is deleted.
Question 3 of 5
Azure Monitor Agent sends Windows event logs from hundreds of VMs to the Event table of a workspace. A downstream analytics platform must receive every new Event record continuously as it arrives. What should you recommend?
Show answer
✅ Answer: A
Difficulty: applied · Topic: Log Analytics data export, Event Hubs
Ways to get data out of a workspace
• Data export rules: continuously export the selected tables to a storage account or Event Hubs as data arrives in Azure Monitor. Up to 10 active rules per workspace; destinations must be in the same region as the workspace; data is exported unfiltered (use transformations to shape it).
• Diagnostic settings on the source resource: if a resource already sends logs through a diagnostic setting, adding another destination there is lower latency, but agent data such as the Event table comes from AMA, not from a diagnostic setting.
• Scheduled queries (Logic Apps, Functions, Data Factory): can filter and aggregate, but are subject to query limits and are not intended for scale.
• Summary rules: aggregate data on a schedule into a custom table in the same workspace.
A workspace's own diagnostic setting
A diagnostic setting on the workspace resource exports the workspace's own resource logs (such as audit of queries), not the contents of its tables.
Why each option works or fails
• ✓ A. B=Data export rule to Event Hubs (correct): an export rule streams every new record of the selected table to an event hub as it arrives, at scale, which is exactly continuous delivery of the Event table (fully supported for export when it comes from AMA).
• ✗ B. Summary rule: a summary rule writes aggregated results into a custom table inside the workspace; it neither sends to an event hub nor delivers every individual record.
• ✗ C. Workspace diagnostic setting: it exports logs about the workspace itself, such as query audit records, not the security events stored in its tables.
• ✗ D. Scheduled Logic App query: query-based export is limited by log query limits, can miss or duplicate records between runs, and Learn states it isn't intended for scale.
Question 4 of 5
A compliance policy requires sign-in audit data to be interactively queryable for 180 days and kept for seven years in total. The data must stay in Log Analytics without a separate export pipeline. What should you recommend?
Show answer
✅ Answer: D
Difficulty: applied · Topic: Log Analytics data retention, search jobs
Analytics, long-term and total retention
A table in Log Analytics keeps data in two states:
• Analytics retention: data is available for interactive queries, alerts and workbooks. For Analytics tables it can be extended up to two years.
• Long-term retention: a low-cost state after analytics retention ends. Total retention (analytics plus long-term) can be set up to 12 years.
Data in long-term retention is retrieved with a search job: an asynchronous query that writes its results into a new Analytics table (_SRCH) that you can then query normally.
Example
Analytics retention 180 days, total retention seven years: queries over the last 180 days run as usual; for an audit of a three-year-old event, a search job pulls the matching rows into a results table.
Why each option works or fails
• ✗ A. Seven years of analytics retention: analytics retention for Analytics tables can be extended only up to two years, and even within that limit it is the expensive state.
• ✗ B. Azure Backup for Log Analytics: Azure Backup has no workload that protects Log Analytics data; long retention is set on the table itself.
• ✗ C. Basic plan for seven years: Basic tables are interactively queryable for only 30 days, so the 180-day interactive requirement is not met.
• ✓ D. B=180 days analytics plus seven years total (correct): this matches both requirements exactly, keeps everything in the workspace, and the five and a half years of long-term retention are billed at the low-cost long-term rate.
Question 5 of 5
Engineers at a partner company need access to an internal engineering web app registered in your Microsoft Entra tenant. They must sign in with their own corporate accounts, and your Conditional Access MFA policy must apply to them. Which solution should you recommend?
Show answer
✅ Answer: D
Difficulty: applied · Topic: Microsoft Entra External ID, B2B collaboration, Conditional Access
External ID has two configurations
• Workforce tenant with B2B collaboration: business partners are added as guest users to the tenant that holds your employees and apps. They authenticate with their home organization or identity provider; no new credentials are created for them.
• External tenant: a separate tenant for publishing apps to consumers and business customers (customer identity and access management).
Policies for guests
In a workforce tenant, Conditional Access policies apply to B2B collaboration users the same way as to employees. Cross-tenant access settings can also be set to trust MFA claims from the partner's Microsoft Entra tenant, so users who already did MFA at home are not prompted twice.
Why each option works or fails
• ✗ A. Sync the partner's directory: syncing another company's Active Directory makes its users members of your directory and needs an agent in their network, far beyond what guest access requires.
• ✗ B. Local member accounts: you create and own new credentials for outsiders, and they no longer sign in with their own corporate identity.
• ✗ C. External tenant: that configuration targets consumer and customer apps; the internal app and its workforce Conditional Access policies live in the workforce tenant.
• ✓ D. B2B collaboration (correct): guests use their partner credentials, sit in the workforce tenant where the app is registered, and fall under the same Conditional Access policies.
🎯 What to remember
• When reviewers must decide in sequence, use a multi-stage access review; single-stage reviews apply the last decision made.
• Choose system-assigned managed identities when actions must be traced to one resource and permissions must vanish with it.
• Continuous, per-table export of workspace data goes through data export rules to Storage or Event Hubs in the workspace's region.
• Combine analytics retention (interactive, up to two years) with total retention (up to 12 years) and use search jobs to reach older data.
• Partners who use their own work accounts to reach your internal apps belong in B2B collaboration in the workforce tenant.
📊 About this set
Exam: AZ-305 · 50 questions · 100 minutes · passing score 700 · the second largest of 4 domains
This set: 4 applied, 1 advanced · 3 scenario, 1 comparison, 1 trade-off
Topics: Microsoft Entra ID Governance, Managed identities for Azure resources, Azure Functions, Log Analytics data export, Event Hubs, Log Analytics data retention, search jobs, Microsoft Entra External ID, B2B collaboration, Conditional Access
🔗 Keep practicing on this blog
• All AZ-305 practice sets
• Every exam on this blog
📚 Keep studying AZ-305
More AZ-305 questions: https://hyunhp.github.io/cert-bank/#exam=AZ-305
Study guide: https://hyunhp.github.io/cert-bank/study.html#exam=AZ-305
These are original practice questions, not real exam questions, and cert-bank is not affiliated with any certification vendor.
Original practice questions written for this blog, not exam dumps.
Comments
Post a Comment