Examkin

All practice questions

1198 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 821Question →

A company has Azure workloads deployed across the East US and North Europe regions. Regulatory compliance mandates that log data originating from North Europe must remain within the European Union (EU) boundaries. The security team must be able to perform central security analytics across all regions using Microsoft Sentinel. Regional operations teams must only access logs from their respective regions. Furthermore, the configuration of diagnostic log routing to the correct regional destination must be automated for all new resources to minimize administrative overhead. Which architecture should you design to meet the requirements?

Show answer & explanation

Answer: Deploy two Log Analytics workspaces: one in East US and one in North Europe. Enable Microsoft Sentinel on both workspaces. Configure Azure Policy with a DeployIfNotExists effect to automatically route diagnostic logs to the local workspace in each region, and assign access using Microsoft Entra ID groups.

Answer

Deploy two Log Analytics workspaces (one in East US and one in North Europe) with Sentinel enabled, configure Azure Policy with a DeployIfNotExists effect to automate regional log routing, and manage access using Microsoft Entra ID groups.
The correct architecture uses separate workspaces in East US and North Europe to comply with data residency regulations. It automates diagnostic configuration using a DeployIfNotExists Azure Policy, which configures log routing without blocking deployments. Finally, it delegates access using Microsoft Entra ID groups, satisfying the requirement to minimize administrative overhead.

Step-by-Step Solution

1
Determine workspace placement based on data residency requirements.
Two separate workspaces are required (East US and North Europe) because North Europe logs must remain within EU boundaries.
Data residency regulations dictate that logs cannot cross geographical boundaries, preventing a single centralized US workspace.
2
Determine the mechanism to automate the configuration of diagnostic log routing.
Azure Policy with a DeployIfNotExists (DINE) effect should be used.
DINE automatically creates diagnostic settings on new resources to route logs to the local workspace without interrupting the resource deployment workflow.
3
Determine the access control mechanism for regional administrators.
Assign Workspace Reader permissions using Microsoft Entra ID groups mapped to the workspaces.
Assigning RBAC permissions to groups instead of individual users simplifies administration and aligns with standard governance guidelines.

Key Concept

Designing compliant, automated, and secure multi-region log routing and workspace architectures in Azure.
Question 822Question →

You are designing a secure, resilient identity architecture for a global corporation with an on-premises Active Directory Domain Services (AD DS) directory and a Microsoft Entra ID tenant. The design must meet the following requirements:

* On-premises users must be synced to Microsoft Entra ID and must be able to authenticate to cloud services even during an on-premises WAN link outage.
* Administrative roles must be secured using Microsoft Entra Privileged Identity Management (PIM) with just-in-time (JIT) activation.
* All administrative actions must require multi-factor authentication (MFA) and a compliant device via a Conditional Access policy.
* The design must include a mitigation plan to prevent tenant lockout in the event of an outage of the Azure MFA service.

Which design strategy should you recommend?

Show answer & explanation

Answer: Configure Microsoft Entra Connect to use Password Hash Synchronization (PHS). Assign administrative roles as eligible in Microsoft Entra Privileged Identity Management (PIM). Create a Conditional Access policy enforcing multi-factor authentication (MFA) and device compliance for administrative users, and explicitly exclude a dedicated, permanently assigned emergency access account that does not require MFA.

Answer

The design strategy that uses Password Hash Synchronization (PHS), eligible PIM assignments, and a Conditional Access policy with an excluded emergency access account is correct.
The correct strategy combines Password Hash Synchronization (PHS) to ensure cloud authentication resilience during on-premises WAN outages, eligible PIM assignments to implement just-in-time administrative access, and a Conditional Access policy that enforces MFA and compliance for administrators while excluding a break-glass emergency account to prevent lockout.

Step-by-Step Solution

1
Select the hybrid authentication mechanism that provides the highest resilience during a local network outage.
Password Hash Synchronization (PHS) is selected over AD FS or Pass-through Authentication (PTA) because it performs authentication entirely in the cloud and does not rely on on-premises infrastructure availability.
This satisfies the requirement that users can authenticate to cloud services even during an on-premises WAN link outage.
2
Determine the PIM role assignment strategy for administrative governance.
Administrative roles must be configured as 'eligible' assignments in PIM.
This allows administrators to activate their roles on-demand (just-in-time), minimizing the attack surface and satisfying the governance requirements.
3
Design the Conditional Access policy to enforce security controls while maintaining emergency access resilience.
Create a Conditional Access policy requiring MFA and compliant devices, target it to administrative users, and configure an exclusion rule for a dedicated emergency access account.
The policy secures administrative roles during normal operations, while the excluded emergency access (break-glass) account ensures that administrators do not get locked out of the tenant in the event of an Azure MFA service failure.

Key Concept

Designing a resilient, secure hybrid identity architecture that balances administrative access control via Conditional Access and PIM with emergency lockout prevention.
Estimated Time:3m 0s
Question 823Question →

A logistics company needs to grant five IT support technicians the capability to manage Azure resources, but only when they are actively resolving support tickets. You need to design a privileged access strategy using Microsoft Entra Privileged Identity Management (PIM) that ensures administrative access is time-bound and adheres to identity governance best practices. Which of the following configurations should you include in your design? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assign the target Azure roles to a Microsoft Entra security group.; Configure the security group's assignment in Microsoft Entra PIM as Eligible.

Answer

The correct approach is to assign the target Azure roles to a Microsoft Entra security group and configure the security group's assignment in Microsoft Entra PIM as Eligible.
Assigning the target Azure roles to a Microsoft Entra security group adheres to the best practice of managing access at the group level rather than the individual level. Configuring the security group's assignment in Microsoft Entra PIM as Eligible ensures that the support technicians do not hold standing privileges and must explicitly activate their access when performing tasks, fulfilling the requirement for time-bound access.

Step-by-Step Solution

1
Evaluate the administrative delegation model.
Identify that assigning roles directly to user accounts is difficult to manage at scale.
Assigning roles to a Microsoft Entra security group simplifies administration and follows governance best practices.
2
Determine the PIM assignment type.
Decide that the assignment must be Eligible rather than Active.
An Eligible assignment requires users to perform just-in-time activation to receive the permissions, whereas an Active assignment grants permanent permissions, violating the principle of least privilege.

Key Concept

Microsoft Entra PIM supports group-based role assignments and eligible states to enforce just-in-time access and scalable governance.
Estimated Time:45s
Question 824Question →

An organization has workloads deployed in the East US and North Europe regions. Regulatory requirements mandate that log data generated in North Europe must reside and be stored within North Europe to comply with data sovereignty regulations. Similarly, logs from East US must remain in the United States. A centralized security audit team based in the United States requires the ability to run ad-hoc compliance queries across the log data of both regions.

You need to design a monitoring and log routing architecture that satisfies these requirements.

Which two configurations should you include in the design?

Select all that apply

Show answer & explanation

Answer: A Log Analytics workspace in the East US region and a separate Log Analytics workspace in the North Europe region to host logs locally.; Cross-workspace queries in Azure Monitor to allow the security audit team to query data across both workspaces.

Answer

To satisfy the requirements, deploy a Log Analytics workspace in the East US region and a separate Log Analytics workspace in the North Europe region to host logs locally, and configure cross-workspace queries in Azure Monitor to allow the security audit team to query data across both workspaces.
Deploying separate Log Analytics workspaces in the East US and North Europe regions ensures that log data is stored locally within its respective region, satisfying data residency regulations. Enabling cross-workspace queries allows the centralized security audit team to run Kusto Query Language (KQL) queries across both workspaces from a single pane of glass without violating sovereignty, as the data itself is not permanently relocated.

Step-by-Step Solution

1
Analyze the regional data residency requirements.
Identified that logs generated in North Europe must stay in North Europe, and logs generated in East US must stay in the United States.
This requires deploying separate Log Analytics workspaces in each region to ensure local storage and compliance.
2
Determine how the central security team can query data without violating residency rules.
Azure Monitor supports cross-workspace queries using Kusto Query Language (KQL).
Cross-workspace queries fetch results dynamically without moving the stored log data from its respective regional workspace.

Key Concept

Designing regional Log Analytics workspaces to meet data sovereignty requirements while enabling centralized querying via cross-workspace queries.
Estimated Time:2m 0s
Question 825Question →

Valerius Logistics is designing a hybrid identity solution to integrate their on-premises Active Directory Domain Services (AD DS) forest, which contains 22,000 users, with a new Microsoft Entra ID tenant.

The design must satisfy the following constraints:
- Authentication: Users must sign in to cloud applications using their on-premises credentials.
- Business Continuity: Cloud authentication must remain functional if the on-premises datacenter experiences an internet connectivity outage.
- Self-Service: Users must be able to reset their expired passwords via the Azure portal, and the changes must immediately update on-premises AD DS.
- Governance: To prevent administrator lockout during a tenant-wide Conditional Access policy deployment, at least two emergency access (break-glass) accounts must be created and excluded from all Multi-Factor Authentication (MFA) policies.

Which solution should you recommend to meet these requirements with the lowest administrative and infrastructure overhead?

Show answer & explanation

Answer: Implement Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable Password Writeback. Create two cloud-only emergency access accounts and exclude them from all Conditional Access multi-factor authentication (MFA) policies.

Answer

Implement Microsoft Entra Connect with Password Hash Synchronization (PHS), enable Password Writeback, and exclude two cloud-only emergency access accounts from all Conditional Access multi-factor authentication policies.
The correct option implements Password Hash Synchronization (PHS) which satisfies the business continuity requirement by validating credentials in the cloud during an on-premises outage. Enabling Password Writeback supports SSPR updating the on-premises AD DS, and excluding the emergency access accounts from CA MFA policies prevents tenant lockout, all while requiring the lowest infrastructure overhead.

Step-by-Step Solution

1
Determine the optimal authentication and business continuity method.
Password Hash Synchronization (PHS) is selected.
Since cloud authentication must function during an on-premises network outage, authentication must occur entirely in the cloud. PHS stores a hash of the hash of user passwords in Microsoft Entra ID. Both Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) require real-time communication with the on-premises environment, which fails during an outage.
2
Identify self-service requirements.
Password Writeback must be enabled.
To support Self-Service Password Reset (SSPR) where changes are immediately reflected on-premises, Password Writeback must be configured in Microsoft Entra Connect.
3
Apply tenant governance and lockout prevention rules.
Two emergency access accounts must be excluded from Conditional Access MFA policies.
To prevent administrative lockout during tenant-wide policy updates or authentication outages, emergency (break-glass) accounts must be cloud-only and explicitly excluded from strict Conditional Access policies.
4
Select the option with the lowest overhead.
PHS with Password Writeback and policy exclusions.
PHS has the lowest infrastructure and administrative overhead because it does not require deploying or maintaining federation servers or highly available PTA agents.

Key Concept

Selecting the appropriate hybrid identity synchronization and authentication mechanism based on business continuity, self-service, and governance requirements.
Estimated Time:2m 0s
Question 826Question →

A digital payments processor is architecting a compliance and access framework for its cloud platform to align with PCI-DSS requirements. The security architecture team must enforce the following access policies:
- External compliance assessors require temporary, time-bound read access to subscription resources. This access must be restricted to a maximum window of four hours, require multi-factor authentication (MFA) upon elevation, and depend on explicit approval from the internal security lead.
- The administrative access footprint must be minimized, avoiding any permanent or standing assignment of privileged permissions to individual users or groups.
- Emergency break-glass accounts must be protected against service-level lockouts (such as an outage affecting the Entra ID multi-factor authentication service) while remaining under strict monitoring.
- All administrative role allocations must be audited regularly, with an automated mechanism to strip access if reviewers do not explicitly approve retention.

Which of the following actions should you recommend in the architectural design to meet these requirements? (Select THREE.)

Select all that apply

Show answer & explanation

Answer: Configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources, assigning a designated auditor security group as eligible for the Reader role with a maximum activation duration of four hours, requiring MFA and approval.; Exclude the emergency break-glass accounts from all Conditional Access policies that enforce multi-factor authentication, and monitor their login events using continuous log analytics alerting.; Establish Microsoft Entra Access Reviews for the privileged groups, and configure the fallback action to 'Remove access' to automatically revoke access if reviewers do not respond.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources with eligibility for the auditor group, exclude emergency break-glass accounts from MFA Conditional Access policies with continuous monitoring, and set Access Review fallback action to 'Remove access'.
The correct recommendations involve: configuring PIM for Azure resources with the auditor group as eligible to prevent standing access while requiring MFA and approval; excluding emergency break-glass accounts from Conditional Access MFA policies to prevent lockout during MFA outages while continuously monitoring them; and setting the access review fallback behavior to 'Remove access' to automate revocation of unreviewed permissions.

Step-by-Step Solution

1
Analyze the requirements for external compliance assessors who need time-bound read access.
Determine that a group-based Privileged Identity Management (PIM) eligible assignment with a 4-hour activation limit, requiring MFA and approval, satisfies this requirement.
This implements the principle of least privilege and just-in-time (JIT) access while minimizing administrative overhead.
2
Analyze the emergency break-glass account requirements.
Determine that these accounts must be excluded from Conditional Access MFA policies to avoid lockout during MFA outages, and their activity must be monitored using alerts.
Excluding emergency accounts from MFA is a critical safeguard against dependency lockouts, and monitoring ensures unauthorized use is immediately detected.
3
Analyze the auditing and automated revocation requirements.
Determine that Microsoft Entra Access Reviews with the 'Remove access' fallback option must be used.
This automates the cleanup of unreviewed or stale access permissions, maintaining a secure state.

Key Concept

Microsoft Entra ID Governance and Privileged Access Management (PIM) architecture, including JIT access, group-based assignment, emergency access mitigation, and automated access reviews.
Question 827Question →

A company is planning the migration of two on-premises SQL Server databases to Azure. The databases have the following requirements:

* Database A hosts a customer management system that requires SQL Server Agent for scheduling maintenance tasks, Database Mail for system alerts, and cross-database queries. The company wants to minimize administrative overhead for managing the operating system and database patches.
* Database B hosts a legacy financial auditing tool. The application requires access to the underlying operating system registry to validate system configuration keys and must run a specialized host-based security agent directly on the database server operating system.

Which two design recommendations should you include? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Deploy Database A to Azure SQL Managed Instance.; Deploy Database B to SQL Server on Azure Virtual Machines.

Answer

Deploy Database A to Azure SQL Managed Instance and deploy Database B to SQL Server on Azure Virtual Machines.
Deploying Database A to Azure SQL Managed Instance and Database B to SQL Server on Azure Virtual Machines is the correct recommendation. Azure SQL Managed Instance is a fully managed PaaS solution that supports SQL Server Agent, Database Mail, and cross-database queries, which satisfies all Database A requirements while eliminating OS-level administrative overhead. SQL Server on Azure Virtual Machines is an IaaS solution that provides full control over the underlying operating system and file system, which is required to meet Database B's need for OS registry access and host-based security agents.

Step-by-Step Solution

1
Analyze Database A's technical requirements and constraints.
Database A requires SQL Server Agent, Database Mail, and cross-database queries, with a desire to minimize OS-level administrative overhead.
These features map directly to Azure SQL Managed Instance, which provides full SQL Server compatibility without the management overhead of virtual machines.
2
Analyze Database B's technical requirements and constraints.
Database B requires OS registry access and the execution of a custom host-based security agent directly on the database server OS.
Managed services (PaaS) like Azure SQL Database and Managed Instance do not allow OS-level access. SQL Server on Azure VMs is the only option that grants full administrative control over the OS.
3
Combine the recommended deployment strategies.
Azure SQL Managed Instance for Database A, and SQL Server on Azure Virtual Machines for Database B.
This combination successfully meets all application feature requirements and OS-level constraints.

Key Concept

Selecting the appropriate Azure SQL deployment option based on application compatibility, OS-level dependencies, and administrative overhead.
Estimated Time:2m 0s
Question 828Question →

An enterprise plans to integrate a newly acquired subsidiary's standalone Azure subscription into its corporate Management Group structure under a single Microsoft Entra tenant.

The corporate architecture team defines the following requirements:
- A custom Azure RBAC role named 'FinancialAuditor' must be created for the subsidiary's audit team.
- The 'FinancialAuditor' role must only be assignable within the '/providers/Microsoft.Management/managementGroups/Corp-Finance-MG' Management Group hierarchy.
- The subsidiary's subscription must be moved under 'Corp-Finance-MG' and inherit all governance controls.
- To maintain security best practices, direct RBAC assignments to individual user accounts are prohibited.

You need to configure the subscription transition and access controls.

Arrange the steps in the correct logical sequence to meet the requirements.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical sequence is: first, define the custom role's JSON structure; second, register the custom role in Azure; third, move the subscription under the target Management Group; fourth, create a Microsoft Entra ID security group; and fifth, assign the custom role to the security group at the Management Group scope.
The correct sequence ensures that prerequisites are met step-by-step. First, the JSON definition must specify the assignable scope (the target Management Group) so that the role cannot be assigned outside it. Second, the role definition must be registered in Azure before it can be assigned. Third, the subscription must be moved under the management group so that it inherits the permissions. Fourth, a security group must be created to hold the users (avoiding direct assignments). Finally, the role assignment is created at the Management Group scope, linking the group to the role, which grants the required access to the subscription via inheritance.

Step-by-Step Solution

1
Define the custom role JSON file with correct AssignableScopes.
A custom role template is created that limits the role's assignment boundary to the target Management Group.
Custom roles require explicit assignable scopes to be defined prior to creation.
2
Register the custom role in the Microsoft Entra tenant.
The 'FinancialAuditor' role becomes available in Azure RBAC.
The role definition must exist in the tenant's registry before it can be assigned to users or groups.
3
Move the subscription to the 'Corp-Finance-MG' Management Group.
The subscription is placed under the management group and is subject to its policy and RBAC boundary.
This establishes the target hierarchy needed for inherited permissions and compliance boundary controls.
4
Create a security group in Microsoft Entra ID and populate it.
A security principal representing the audit team is created.
Azure best practice dictates using group-based RBAC assignments rather than direct user assignments to minimize administrative overhead.
5
Assign the custom role to the security group at the Management Group scope.
The group's members receive the defined permissions on the target subscription via inheritance.
Assigning the role at the Management Group scope applies the permissions to all child resources within that hierarchy.

Key Concept

Azure RBAC Custom Role creation, Assignable Scopes validation, Management Group inheritance, and Group-based role assignment.
Question 829Question →

Solaris Heavy Industries is designing a hybrid identity and collaboration solution. The company has an on-premises Active Directory Domain Services (AD DS) forest named solaris.local that contains 12,500 user accounts. They recently acquired a subsidiary that uses an independent Microsoft Entra ID tenant named aurora-aviation.onmicrosoft.com.

You need to design a solution that meets the following requirements:
- Users in solaris.local must be synchronized to the primary Microsoft Entra tenant (solaris-heavy.onmicrosoft.com) and must be able to authenticate to Azure resources even if the on-premises network link to Azure is temporarily offline.
- On-premises users must be able to change their passwords using Microsoft Entra Self-Service Password Reset (SSPR), and the changes must update the on-premises AD DS immediately.
- Guest users from aurora-aviation.onmicrosoft.com must be allowed to access shared resources in solaris-heavy.onmicrosoft.com securely.
- You must minimize administrative overhead and avoid hosting extra on-premises federation servers.

Which two components should you include in the hybrid identity design? (Select two.)

Select all that apply

Show answer & explanation

Answer: Microsoft Entra Connect Sync with Password Hash Synchronization (PHS) and password writeback enabled; Microsoft Entra B2B collaboration with cross-tenant access settings configured to allow guest access

Answer

The hybrid identity design must include Microsoft Entra Connect Sync with Password Hash Synchronization (PHS) and password writeback enabled, and Microsoft Entra B2B collaboration with cross-tenant access settings configured to allow guest access.
Microsoft Entra Connect Sync with Password Hash Synchronization (PHS) and password writeback enabled satisfies the authentication requirement under offline conditions and allows on-premises password updates via SSPR. Microsoft Entra B2B collaboration with cross-tenant access settings securely incorporates users from the subsidiary's tenant with minimal administrative effort.

Step-by-Step Solution

1
Evaluate hybrid authentication methods against the offline resilience requirement.
Password Hash Synchronization (PHS) is selected because authentication is processed entirely in the cloud, removing dependency on the on-premises link.
Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) require active, real-time connectivity to on-premises servers to authenticate users, failing the business continuity constraint.
2
Identify self-service password modification requirements.
Password writeback must be enabled on the Microsoft Entra Connect sync server.
This allows self-service password reset (SSPR) actions performed in the cloud to be written back to the on-premises Active Directory Domain Services.
3
Select the secure collaboration method with the lowest administrative overhead.
Microsoft Entra B2B collaboration with cross-tenant access settings is chosen.
This permits secure, multi-tenant collaboration between the primary tenant and the newly acquired subsidiary's tenant without configuring complex external federation structures.

Key Concept

Designing a resilient, low-overhead hybrid identity solution that combines local Active Directory synchronization, password writeback, and multi-tenant B2B collaboration settings.
Question 830Question →

You are designing an identity governance solution for a company's Azure environment. You need to grant support staff temporary, time-bound access to administrative roles. The solution must prevent permanent standing access and follow administrative best practices for identity delegation. Which configuration should you recommend?

Show answer & explanation

Answer: Configure eligible role assignments for a Microsoft Entra security group containing the support staff.

Answer

Configure eligible role assignments for a Microsoft Entra security group containing the support staff.
Configuring eligible role assignments ensures that users do not have standing privileges and must request activation to use the role, which provides just-in-time (JIT) access. Assigning the role to a security group containing the support staff aligns with governance best practices by avoiding direct assignments to individual user accounts.

Step-by-Step Solution

1
Identify the requirement for temporary, time-bound administrative access.
This requires Microsoft Entra Privileged Identity Management (PIM) with eligible assignments, enabling just-in-time (JIT) role activation.
Eligible assignments require users to explicitly perform activation steps to acquire the role, whereas active assignments grant standing access.
2
Apply identity governance best practices for role assignments.
Assign the eligible roles to a Microsoft Entra security group rather than individual user accounts.
Group-based assignment reduces administrative overhead and ensures scalable management of role eligibility.

Key Concept

Just-In-Time (JIT) access using Privileged Identity Management (PIM) eligible assignments mapped to security groups.
Estimated Time:1m 0s
Question 831Question →

You are designing an Azure storage solution for critical database backups. The backups must remain available and survive the physical failure of a primary Azure datacenter. To minimize costs, you must avoid replicating data across different Azure regions. Which storage redundancy option should you recommend?

Show answer & explanation

Answer: Zone-redundant storage (ZRS)

Answer

Zone-redundant storage (ZRS)
Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones in the primary region. Because availability zones are physically separate datacenters with independent power, cooling, and networking, ZRS ensures that the backups remain available even if a primary datacenter fails. Furthermore, it keeps data within the primary region, minimizing costs and satisfying the constraint against cross-region replication.

Step-by-Step Solution

1
Analyze the resiliency and datacenter failure requirements.
The backups must survive the physical failure of a primary Azure datacenter.
This rules out Locally redundant storage (LRS), which only replicates data within a single datacenter.
2
Evaluate the cost and regional replication constraints.
The solution must minimize costs and avoid replicating data across different Azure regions.
This rules out Geo-redundant storage (GRS) and Read-access geo-redundant storage (RA-GRS), which replicate data to a secondary region and incur higher costs.
3
Select the option that meets both datacenter resiliency and local region constraints.
Zone-redundant storage (ZRS) meets these requirements by replicating data across three separate availability zones within the primary region.
ZRS provides zone-level resiliency against datacenter outages without the cost and complexity of cross-region replication.

Key Concept

Selecting the appropriate Azure storage redundancy option based on cost, regional constraints, and resiliency requirements.
Estimated Time:45s
Question 832Question →

An enterprise is designing a hybrid identity and access management solution. The enterprise currently synchronizes its on-premises Active Directory Domain Services (AD DS) environment to Microsoft Entra ID.

The design must satisfy the following requirements:
- Ensure that users can authenticate to cloud resources even if the on-premises network or AD DS domain controllers become unavailable.
- Require multi-factor authentication (MFA) for all administrative access to the Azure portal.
- Prevent administrative lockout of the tenant if there is a regional Microsoft Entra MFA service outage.
- Restrict administrative roles for standard IT administrators to just-in-time (JIT) access.

Which authentication and access control configuration should you recommend?

Show answer & explanation

Answer: Implement Password Hash Synchronization (PHS) for hybrid authentication. Configure a Conditional Access policy requiring multi-factor authentication (MFA) for administrative roles, and exclude a dedicated emergency access account that has a permanently assigned Global Administrator role.

Answer

The configuration that implements Password Hash Synchronization (PHS), requires multi-factor authentication (MFA) via Conditional Access for administrators with an exclusion for a permanently assigned emergency access account.
The correct solution uses Password Hash Synchronization (PHS) to allow independent cloud authentication during on-premises outages. It uses Privileged Identity Management (PIM) to enforce just-in-time (JIT) eligible role assignments for standard administrators. To prevent lockout during an MFA outage, a dedicated emergency access account is permanently assigned the Global Administrator role and explicitly excluded from the MFA Conditional Access policy.

Step-by-Step Solution

1
Select the hybrid authentication method that ensures cloud authentication resiliency.
Password Hash Synchronization (PHS) is selected instead of AD FS.
PHS allows authentication to be processed directly by Microsoft Entra ID, ensuring authentication availability even when on-premises domain controllers or network connectivity are offline.
2
Design the administration access method.
Standard administrative accounts are configured as eligible in Microsoft Entra Privileged Identity Management (PIM).
This meets the requirement to enforce just-in-time (JIT) administrative access rather than permanent access.
3
Configure the security policy for portal access and lockout prevention.
Create a Conditional Access policy requiring MFA for administrative roles, and exclude a dedicated emergency access account that has a permanently assigned Global Administrator role.
Excluding the emergency account from MFA ensures that if the MFA service is down or if there is a policy misconfiguration, administrators can still log in to remediate issues. The emergency account must have a permanent assignment because PIM activation requires access that may be unavailable during an outage.

Key Concept

Microsoft Entra ID Authentication, Conditional Access exclusions, and Privileged Identity Management resiliency configuration
Question 833Question →

Veridian Finance is designing a governance and security strategy for its Azure environment. The security team establishes the following compliance mandates for all Azure Key Vault instances:

1. Every Key Vault must have diagnostic logs enabled. If a Key Vault is deployed without diagnostic logs, a Diagnostic Setting must be automatically created to forward the logs to a central Log Analytics workspace.
2. Every Key Vault must have public network access disabled. Any deployment attempt of a Key Vault with public network access enabled must be blocked.

You need to select the Azure Policy effects that meet these compliance mandates while minimizing administrative overhead.

Which policy effects should you recommend?

Show answer & explanation

Answer: DeployIfNotExists for the diagnostic logs, and Deny for the public network access

Answer

DeployIfNotExists for the diagnostic logs, and Deny for the public network access
The DeployIfNotExists effect is required to automatically deploy a diagnostic setting (which is a child resource) when a Key Vault is created without one. The Deny effect blocks the creation or update of resources that do not comply with the specified rules, which matches the requirement to prevent Key Vaults from being deployed with public network access enabled.

Step-by-Step Solution

1
Analyze the automatic log enablement requirement to determine the correct policy effect.
Creating diagnostic logs involves deploying a separate child resource (Microsoft.Insights/diagnosticSettings). In Azure Policy, deploying templates to remediate or create child resources requires the DeployIfNotExists effect.
The DeployIfNotExists effect evaluates the compliance of the parent resource and executes an ARM template deployment to create the missing child resource.
2
Analyze the requirement to prevent deployment of Key Vaults with public network access.
The requirement specifies that any deployment attempt violating this rule must be blocked. The Deny effect is the standard Azure Policy effect used to block non-compliant requests before creation.
This is necessary because the Deny effect is evaluated during the Azure Resource Manager validation phase and prevents the resource creation or update if the rule evaluation evaluates to true.

Key Concept

Azure Policy effects are chosen based on the desired behavior: blocking non-compliant changes (Deny) or automatically deploying resources/settings when they are missing (DeployIfNotExists).
Estimated Time:1m 30s
Question 834Question →

Your enterprise is designing a monitoring and log routing solution. You need to match each monitoring requirement to the correct Azure service or configuration that satisfies the requirement at the lowest cost and complexity.

Match each log routing requirement on the left to its most appropriate Azure resource or configuration on the right.

Click a left item, then click its matching right item

Items

Stream Azure Key Vault diagnostic logs to a non-Azure SIEM system with sub-minute latency
Retain Virtual Network flow logs for 77 years to meet regulatory compliance at the lowest possible cost
Collect system event logs from both Azure virtual machines and on-premises physical servers in a unified repository
Store resource logs in a repository that supports Kusto Query Language (KQL) for ad-hoc troubleshooting

Matches

Show answer & explanation

Answer

Stream diagnostic logs to SIEM matches Azure Event Hubs; Retain flow logs for 77 years matches Azure Storage Account; Collect logs from hybrid servers matches Log Analytics workspace with the Azure Monitor Agent; Store logs for KQL queries matches Log Analytics workspace.
Streaming logs to SIEM maps to Azure Event Hubs because it acts as an ingestion pipeline for third-party consumers. Multi-year low-cost archiving maps to Azure Storage Accounts. Hybrid event collection maps to the Azure Monitor Agent since it supports both Azure VMs and on-premises servers. Ad-hoc querying via KQL maps directly to Log Analytics workspace storage.

Step-by-Step Solution

1
Analyze the real-time SIEM ingestion requirement.
Identify that streaming logs to non-Azure destinations in near real-time requires an event pipeline.
Azure Event Hubs is the standard broker for routing diagnostic data to third-party SIEM providers.
2
Evaluate the 77-year long-term log retention requirement under cost constraints.
Identify that Log Analytics is too expensive for long-term passive retention, whereas Storage Accounts are cost-efficient.
An Azure Storage Account with cool or archive tier is the lowest-cost option for multi-year retention compliance.
3
Examine the hybrid collection requirement for virtual and physical servers.
Determine the agent needed to bridge Azure and on-premises workloads.
The Azure Monitor Agent (AMA) supports both Azure VMs and hybrid physical servers (via Azure Arc) to collect and forward logs to a Log Analytics workspace.
4
Analyze the interactive KQL query requirement.
Identify the repository that natively exposes a KQL query engine.
A Log Analytics workspace stores log data in structured tables that can be queried directly using Kusto Query Language (KQL).

Key Concept

Selecting log routing targets and collection mechanisms in Azure Monitor based on latency, cost, hybrid scope, and query requirements.
Estimated Time:2m 0s
Question 835Question →

A company is planning to migrate a legacy inventory application to Azure. The application's database relies heavily on SQL Server Agent for automated job scheduling and requires cross-database queries between multiple databases on the same server instance. The company wants to minimize administrative overhead and avoid managing the underlying operating system. Which Azure SQL deployment option should you recommend?

Show answer & explanation

Answer: Azure SQL Managed Instance

Answer

Azure SQL Managed Instance
Azure SQL Managed Instance provides near-100% feature compatibility with the SQL Server database engine, including support for SQL Server Agent and cross-database queries, while operating as a fully managed PaaS service that eliminates operating system management overhead.

Step-by-Step Solution

1
Analyze the technical requirements of the database migration, focusing on feature compatibility.
The database requires native support for SQL Server Agent and cross-database queries.
These are instance-level features of SQL Server.
2
Analyze the administrative constraints for the target database service.
The target option must minimize administrative overhead and avoid operating system management.
This requirement indicates a Platform as a Service (PaaS) model rather than Infrastructure as a Service (IaaS).
3
Evaluate the Azure SQL deployment options to find the best fit.
Azure SQL Managed Instance satisfies the PaaS constraint and supports instance-level features like SQL Server Agent and cross-database queries.
It offers the management benefits of a fully managed database alongside the instance-level feature set required for migration.

Key Concept

Azure SQL deployment option selection based on feature compatibility and administrative overhead requirements
Question 836Question →

Aethelgard Manufacturing has an on-premises Active Directory Domain Services (AD DS) forest named internal.aethelgard.net with 14,000 users. The company has a primary Microsoft Entra ID tenant (aethelgard.com) and recently acquired a subsidiary that uses a separate Entra ID tenant (subsidiary.aethelgard.com). You are designing a hybrid identity and multi-tenant access solution to meet the following requirements:
1. On-premises users must be able to sign in to Microsoft 365 services.
2. The authentication method must support user logins even during a complete outage of the on-premises network or domain controllers.
3. Users must be able to reset their own passwords in the cloud, and these resets must be immediately written back to the on-premises AD DS.
4. You must enforce Multi-Factor Authentication (MFA) via Conditional Access for all standard users, but you must prevent a tenant lockout if the MFA service suffers an outage.
5. Users in the subsidiary tenant must be able to access shared line-of-business applications in the primary tenant using their existing credentials.

Which of the following designs should you recommend?

Show answer & explanation

Answer: Deploy Microsoft Entra Connect Sync with Password Hash Synchronization (PHS) and enable Password Writeback. Configure a Conditional Access policy enforcing MFA for all users, excluding a designated emergency access (break-glass) account. Configure Microsoft Entra B2B collaboration with cross-tenant access settings to allow subsidiary users to access primary tenant applications.

Answer

Deploy Microsoft Entra Connect Sync with Password Hash Synchronization (PHS) and enable Password Writeback. Configure a Conditional Access policy enforcing MFA for all users, excluding a designated emergency access (break-glass) account. Configure Microsoft Entra B2B collaboration with cross-tenant access settings to allow subsidiary users to access primary tenant applications.
The correct design uses Password Hash Synchronization (PHS) with Password Writeback, includes an emergency account exclusion in the Conditional Access MFA policy, and configures Microsoft Entra B2B collaboration. PHS meets the business continuity requirement because user credentials are validated directly in the cloud, ensuring sign-ins succeed even if the on-premises network is offline. Password Writeback ensures self-service password changes sync back to the local AD DS. Excluding emergency accounts from the CA policy avoids complete tenant lockout during MFA outages. Finally, Microsoft Entra B2B collaboration enables cross-tenant access without credential duplication.

Step-by-Step Solution

1
Select the hybrid authentication method that provides business continuity during local outages.
Password Hash Synchronization (PHS) is selected.
Unlike Pass-through Authentication (PTA) or Active Directory Federation Services (AD FS), PHS syncs a hash of the user's password to the cloud, enabling Entra ID to perform authentication locally in the cloud even if the on-premises network or domain controllers are down.
2
Enable self-service password reset with writeback to the on-premises directory.
Password Writeback is configured in Entra Connect.
This allows self-service password reset (SSPR) actions in the cloud to be synchronized immediately back to the on-premises Active Directory Domain Services.
3
Implement Conditional Access policies with tenant lockout prevention.
Conditional Access policy is created targeting all users for MFA, with an explicit exclusion for emergency access accounts.
Excluding designated break-glass accounts ensures that administrative access remains available in case of an MFA outage, satisfying the security/resilience constraint.
4
Establish secure cross-tenant collaboration for the subsidiary.
Microsoft Entra B2B collaboration and cross-tenant access settings are enabled.
This allows users from the subsidiary tenant to log in using their own credentials to access applications in the primary tenant.

Key Concept

Designing a resilient, secure hybrid identity architecture with multi-tenant collaboration using Password Hash Synchronization, Password Writeback, Conditional Access exclusions, and Entra B2B.
Question 837Question →

A global pharmaceutical firm is designing the cloud architecture for its new drug discovery and manufacturing platform. The architecture requires deploying two distinct relational database workloads:

* Workload 1 runs a proprietary legacy control application. It requires a relational database that executes scheduled tasks via SQL Server Agent, requires operating system-level registry modifications, and must run a proprietary third-party assembly that requires access to the local host filesystem.
* Workload 2 runs an analytics ingestion application. It requires cross-database queries across three databases, SQL Server Agent for scheduled data consolidation, and native Common Language Runtime (CLR) integration. Operating system management must be fully offloaded to Azure to minimize administrative overhead.

Which two Azure SQL solutions should you recommend to support these workloads?

Select all that apply

Show answer & explanation

Answer: SQL Server on Azure Virtual Machines for Workload 1; Azure SQL Managed Instance for Workload 2

Answer

Select SQL Server on Azure Virtual Machines for Workload 1 and Azure SQL Managed Instance for Workload 2.
For Workload 1, the requirement for operating system registry modifications and local host filesystem access necessitates SQL Server on Azure Virtual Machines (an IaaS solution). For Workload 2, the requirement for SQL Server Agent, CLR, and cross-database queries combined with a need to eliminate OS administrative overhead is satisfied by Azure SQL Managed Instance (a PaaS solution).

Step-by-Step Solution

1
Analyze the requirements for Workload 1.
Workload 1 requires OS-level registry access and local filesystem access for a third-party assembly.
This rules out all fully managed platform-as-a-service (PaaS) options such as Azure SQL Database and Azure SQL Managed Instance, which do not permit host OS access.
2
Select the correct service for Workload 1.
SQL Server on Azure Virtual Machines is the only relational option providing full OS-level administration.
An infrastructure-as-a-service (IaaS) model is necessary whenever an application depends on operating system configurations or running legacy third-party software that interacts directly with the host filesystem.
3
Analyze the requirements for Workload 2.
Workload 2 requires SQL Server Agent, cross-database queries, and CLR, but must avoid OS management overhead.
These requirements match the feature set of a managed relational service that supports instance-level capabilities.
4
Select the correct service for Workload 2.
Azure SQL Managed Instance is chosen.
Unlike Azure SQL Database single database (which lacks SQL Server Agent and native cross-database query support), Managed Instance provides instance-scoped features without OS management overhead.

Key Concept

Selecting appropriate Azure SQL services based on legacy feature requirements (SQL Agent, CLR, cross-database queries) and operational model constraints (OS access vs. managed service).
Question 838Question →

An organization named Litware, Inc. has an Azure environment structured with a management group hierarchy. The hierarchy includes a parent management group named TenantRoot, with two child management groups named Production-MG and Development-MG.

The security compliance team mandates the following requirements:
* All virtual machines deployed within Production-MG must have the Azure Monitor Agent installed automatically.
* Any attempt to deploy a storage account within Production-MG that does not enforce secure transit (HTTPS) must be blocked at deployment.
* Development-MG must not be subjected to these compliance rules.

You need to design an Azure Policy solution to meet these requirements with the least amount of administrative overhead.

Which two configurations should you recommend? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign a policy initiative to the Production-MG management group containing a policy definition with the DeployIfNotExists effect to deploy the Azure Monitor Agent.; Include a policy definition with the Deny effect in the policy initiative to block the creation of storage accounts without secure transit enabled.

Answer

Assign a policy initiative with the DeployIfNotExists effect to Production-MG and include a policy definition with the Deny effect in the initiative.
To meet the compliance requirements with minimum administrative overhead, we assign a policy initiative containing the required policy definitions directly to the Production-MG management group. The requirement to automatically deploy the Azure Monitor Agent is best met using the DeployIfNotExists effect, which deploys the agent extension if it is missing. The requirement to block storage accounts without secure transit enabled is met using the Deny effect, which rejects the deployment request if compliance conditions are not met.

Step-by-Step Solution

1
Determine the appropriate policy assignment scope and grouping.
Create a policy initiative and assign it directly to Production-MG. This avoids assigning to the TenantRoot with exclusions (notScopes), reducing administrative overhead.
Assigning at the closest shared scope containing only production resources avoids unnecessary policy evaluations and exclusion management.
2
Select the policy effect for the Azure Monitor Agent requirement.
Use the DeployIfNotExists (DINE) effect to install the Azure Monitor Agent.
DeployIfNotExists automatically deploys the template for the Azure Monitor Agent if the virtual machine is deployed without it, fulfilling the automatic installation requirement.
3
Select the policy effect for the secure transit requirement.
Use the Deny effect to block storage accounts without secure transfer enabled.
The Deny effect prevents the resource creation request from succeeding if the resource fails validation, enforcing immediate compliance before deployment.

Key Concept

Azure Policy effects (DeployIfNotExists, Deny) and assignment scopes to govern resource compliance with minimal administrative overhead.
Question 839Question →

An organization is designing an identity and access management architecture for its new Microsoft Entra ID tenant. The organization currently has an on-premises Active Directory Domain Services (AD DS) environment.

The design must satisfy the following technical requirements:
- Synchronize hybrid user accounts to Microsoft Entra ID while minimizing on-premises infrastructure footprint, maintenance overhead, and licensing costs.
- Secure highly privileged administrative roles by enforcing Just-In-Time (JIT) access, requiring Multi-Factor Authentication (MFA) upon role activation.
- Safeguard against accidental administrative lockout from the tenant during a widespread MFA service disruption or policy misconfiguration.

Which two of the following design recommendations should you include to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Recommend Password Hash Synchronization (PHS) with Seamless Single Sign-On (SSO) as the hybrid identity authentication method.; Configure eligible administrative role assignments in Privileged Identity Management (PIM), and exclude emergency access accounts from the Conditional Access MFA policies.

Answer

Recommend Password Hash Synchronization (PHS) with Seamless Single Sign-On (SSO) as the hybrid identity authentication method, and configure eligible administrative role assignments in Privileged Identity Management (PIM) while excluding emergency access accounts from the Conditional Access MFA policies.
Selecting Password Hash Synchronization (PHS) with Seamless SSO provides a high-availability identity solution with the smallest on-premises infrastructure footprint. Pairing this with eligible role assignments in Privileged Identity Management (PIM) enforces Just-In-Time access. Finally, excluding emergency access accounts from Conditional Access policies avoids administrative lockout in the event of an MFA service failure.

Step-by-Step Solution

1
Select the hybrid authentication model that minimizes on-premises infrastructure.
Password Hash Synchronization (PHS) with Seamless Single Sign-On (SSO) is selected.
PHS does not require additional on-premises servers or inbound network access, unlike Active Directory Federation Services (AD FS) or Pass-through Authentication (PTA) with multiple agents.
2
Address the requirement for Just-In-Time (JIT) access and administrative MFA.
Configure eligible assignments in Privileged Identity Management (PIM) that require MFA verification upon activation.
Eligible assignments prevent permanent privilege accumulation and ensure admins are only granted roles temporarily after performing MFA.
3
Design lockout prevention measures for emergency tenant access.
Create emergency access (break-glass) accounts and exclude them from Conditional Access MFA policies.
If MFA is globally enforced without exclusions, a service disruption or policy misconfiguration can permanently lock all administrators out of the tenant.

Key Concept

Microsoft Entra ID hybrid identity design, Just-In-Time administrative governance, and Conditional Access lockout resilience.
Question 840Question →

An organization is migrating a media processing application to Azure and has identified two key storage requirements:

1. A shared file system to store active media assets. This file system must support the NFS protocol, deliver sub-millisecond latency, and survive a zone-wide datacenter outage.
2. A long-term repository for historical project logs. These logs must be stored at the lowest possible storage cost, but they must be accessible within 1010 minutes when requested by compliance auditors.

Which two storage configurations should you recommend to meet these requirements?

Select all that apply

Show answer & explanation

Answer: An Azure Files Premium share using Zone-Redundant Storage (ZRS) for the active media assets.; An Azure Blob Storage account configured with the Cool tier for the historical project logs.

Answer

An Azure Files Premium share using Zone-Redundant Storage (ZRS) for the active media assets, and an Azure Blob Storage account configured with the Cool tier for the historical project logs.
The correct configurations are an Azure Files Premium share using Zone-Redundant Storage (ZRS) and an Azure Blob Storage account using the Cool tier. NFS file shares are restricted to the Premium tier of Azure Files, which is designed to provide sub-millisecond latency. Opting for Zone-Redundant Storage (ZRS) satisfies the business continuity requirement by replicating data across three availability zones. For the historical logs, the requirement to access files within ten minutes eliminates the Archive tier because of its multi-hour rehydration latency. The Cool tier serves as the most cost-effective online tier that allows instant data access.

Step-by-Step Solution

1
Determine the storage tier and redundancy for the shared NFS system.
Azure Files Premium tier is selected because NFS file shares are only supported on Premium. Zone-Redundant Storage (ZRS) is chosen to survive zone-wide outages.
NFS protocol support and sub-millisecond latency require Azure Files Premium, while zone outage resilience requires ZRS.
2
Evaluate the tier requirements for the historical project logs.
Azure Blob Storage Cool tier is selected.
Although the Archive tier is cheaper, its high rehydration latency prevents access within the required ten-minute window. The Cool tier offers low-cost storage with sub-second retrieval times.

Key Concept

Selecting Azure storage services, tiers, and redundancy levels based on latency, protocol, availability, and recovery time objectives.
PreviousPage 42 / 60Next
All practice questions — Microsoft Azure Solutions Architect (AZ-305) | Examkin