Examkin

All practice questions

1198 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 101Question →

An enterprise is designing a monitoring and log routing architecture for a multi-region workload deployed in East US and West Europe. The architecture must meet the following requirements:
- Logs generated by resources in West Europe must remain resident within the European Union (EU) to comply with data sovereignty regulations.
- Access to logs must be restricted so that application developers can only view diagnostic data for the specific resources they own, without having access to other resources' logs stored in the same workspace.
- Diagnostic logs from Azure Key Vault and Azure SQL Database instances must be streamed in real-time to a third-party SIEM platform in each respective region.
- Administrative overhead for managing log access permissions must be minimized.

Which two components or configurations should you include in the design to meet these requirements? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Separate Log Analytics workspaces in East US and West Europe configured to use resource-context access control.; An Azure Event Hubs namespace in each region with diagnostic settings configured on resources to stream logs to their regional event hub.

Answer

Configure separate Log Analytics workspaces in East US and West Europe using resource-context access control, and deploy regional Azure Event Hubs namespaces with diagnostic settings configured to stream resource logs to their respective regional event hubs.
The correct options are configuring separate Log Analytics workspaces in each region using resource-context access control, and deploying regional Azure Event Hubs namespaces to stream logs via diagnostic settings. Creating separate workspaces ensures that EU log data remains physically stored in Europe, satisfying sovereignty requirements. Resource-context access ensures that developers can only see logs for resources they are authorized to manage, without workspace-level permissions. Event Hubs namespaces in both regions provide the required real-time streaming capability to the SIEM tool while maintaining regional data compliance.

Step-by-Step Solution

1
Address data sovereignty and residency constraints.
Determine that logs generated in West Europe must remain resident in the EU, necessitating separate Log Analytics workspaces in East US and West Europe rather than a single centralized workspace.
Regulatory compliance (e.g., GDPR) forbids sending EU diagnostic data to a US-based workspace, requiring regional isolation of storage.
2
Configure granular access control for developers while minimizing administrative overhead.
Select resource-context access control for the Log Analytics workspaces.
Resource-context access automatically allows developers to view logs for only the resources they own (based on their resource-level RBAC permissions), eliminating the overhead of managing permissions at the workspace level.
3
Design the log routing path for real-time SIEM ingestion.
Incorporate regional Azure Event Hubs namespaces and configure diagnostic settings on the resources to route logs to the local Event Hub.
Azure Event Hubs provides the low-latency streaming needed for SIEM ingestion, and keeping them in their respective regions aligns with the data residency constraints.

Key Concept

Designing regional log routing architectures to satisfy data sovereignty while leveraging resource-context RBAC to minimize monitoring administrative overhead.
Question 102Question →

An organization is designing a hybrid identity architecture to connect their on-premises Active Directory Domain Services (AD DS) environment to Microsoft Entra ID. How should you match each security or authentication requirement to the correct Microsoft Entra ID authentication or Conditional Access feature?

Click a left item, then click its matching right item

Items

Require multi-factor authentication (MFA) when users access cloud applications from outside the corporate office network.
Validate user credentials against the on-premises Active Directory using a lightweight local agent, without storing password hashes in the cloud.
Verify user identity in the cloud by comparing credential hashes against synchronized password hashes stored in Microsoft Entra ID.

Matches

Show answer & explanation

Answer

Require MFA outside corporate network matches Conditional Access policy with location and grant controls; Validate credentials on-premises without cloud hashes matches Pass-through Authentication (PTA); Verify identity with synchronized cloud hashes matches Password Hash Synchronization (PHS).
Conditional Access policies evaluate network location signals and enforce MFA grant controls. Pass-through Authentication (PTA) routes credential checks directly to on-premises AD via local agents without storing cloud hashes. Password Hash Synchronization (PHS) synchronizes user password hashes to enable cloud-native authentication.

Step-by-Step Solution

1
Analyze the first requirement: requiring MFA when users connect from outside the corporate network.
This requires checking the user's location (network signal) and enforcing an access control (MFA), which is a key capability of Conditional Access policies.
Conditional Access evaluates signals like location to enforce organization policies.
2
Analyze the second requirement: validating credentials against on-premises Active Directory using a lightweight local agent without storing hashes in the cloud.
This aligns with Pass-through Authentication (PTA), which forwards the authentication request to an on-premises agent.
PTA keeps credentials validation on-premises and does not store user passwords or hashes in the cloud.
3
Analyze the third requirement: verifying user identity in the cloud using synchronized password hashes.
This aligns with Password Hash Synchronization (PHS), which synchronizes a hash of the user's on-premises Active Directory password hash.
PHS allows authentication to occur directly in Microsoft Entra ID using stored hashes.

Key Concept

Microsoft Entra ID hybrid authentication and Conditional Access policy design
Question 103Question →

Your organization has a new Azure subscription. You need to grant administrative access to five new cloud engineers. The solution must minimize administrative overhead and align with Azure governance best practices. How should you assign the required access?

Show answer & explanation

Answer: Create a Microsoft Entra ID security group, add the five cloud engineers as members, and assign the required RBAC role to the group at the subscription scope.

Answer

Create a Microsoft Entra ID security group, add the five cloud engineers as members, and assign the required RBAC role to the group at the subscription scope.
The correct approach is to assign the RBAC role to a Microsoft Entra security group. By grouping users, you simplify access control administration. When team members change, you only need to update the group membership rather than managing individual role assignments at the subscription level.

Step-by-Step Solution

1
Create a Microsoft Entra ID security group representing the team of cloud engineers.
A security group is created in Microsoft Entra ID.
Security groups serve as a single management point for collection of users with identical permission requirements.
2
Add the five cloud engineers to the newly created security group.
The users become members of the group and will inherit any access assigned to the group.
This isolates group membership changes from Azure RBAC assignments, reducing subsequent modifications at the scope level.
3
Assign the required RBAC role to the security group at the subscription scope.
All members of the group receive administrative access to the subscription.
This grants permissions efficiently while ensuring scalable access management.

Key Concept

Group-based access control in Azure RBAC
Question 104Question →

A healthcare provider hosts a telehealth application with Azure resources deployed in both the East US and West Europe regions. To satisfy regulatory requirements, diagnostic logs from the West Europe resources must be stored strictly within the European Union, while logs from East US resources must reside within the United States. The access to these logs must be restricted to regional auditing teams, and administrative management overhead for the monitoring infrastructure must be minimized. Which log routing and workspace configuration should you recommend to meet these requirements?

Show answer & explanation

Answer: Deploy one Log Analytics workspace in West Europe and another in East US, configure diagnostic settings on regional resources to route to their respective local workspaces, and assign log access permissions to regional auditor groups using Microsoft Entra ID groups.

Answer

Deploy one Log Analytics workspace in West Europe and another in East US, configure diagnostic settings on regional resources to route to their respective local workspaces, and assign log access permissions to regional auditor groups using Microsoft Entra ID groups.
The correct architecture requires separate Log Analytics workspaces in West Europe and East US to adhere to strict data residency and sovereignty requirements, as data in Log Analytics resides within the workspace's region. Access control is managed cleanly and securely by assigning the required permissions to Microsoft Entra ID groups representing the regional auditors rather than individual users.

Step-by-Step Solution

1
Analyze data residency and sovereignty requirements.
Identified that logs from the West Europe region must reside in the EU, and logs from the East US region must reside in the US. This necessitates deploying at least two separate Log Analytics workspaces, one in each region, to maintain data residency compliance.
Log Analytics workspaces store data in the region where the workspace is created; logs cannot be consolidated into a single workspace if geographic segregation is legally required.
2
Evaluate access management and governance best practices.
Determined that access should be granted to groups of regional auditors rather than individual users to keep management scalable.
Assigning Azure RBAC permissions to Microsoft Entra ID groups instead of individual user accounts minimizes administrative overhead and aligns with the principle of least privilege and scalability.
3
Select the correct deployment mechanism for configuring diagnostic settings.
Rejected using a Deny policy effect for automatic deployment, noting that DeployIfNotExists is the correct policy effect for auto-configuring diagnostics.
Deny effect will prevent resource creation if settings are missing, whereas DeployIfNotExists will automatically provision the diagnostic settings upon deployment.

Key Concept

Designing compliant Azure Monitor architectures that respect data residency rules and follow Microsoft Entra ID RBAC best practices.
Question 105Question →

A company is designing a new relational database solution in Azure. The database has the following requirements:

* Must support SQL Server Agent for scheduling internal database maintenance tasks.
* Must be deployed with a private IP address within an Azure Virtual Network (VNet).

Which two Azure SQL deployment options meet these requirements?

Select all that apply

Show answer & explanation

Answer: SQL Server on Azure Virtual Machines; Azure SQL Managed Instance

Answer

SQL Server on Azure Virtual Machines and Azure SQL Managed Instance
SQL Server on Azure Virtual Machines and Azure SQL Managed Instance both natively support SQL Server Agent. Additionally, both options are deployed directly within an Azure Virtual Network, giving them private IP addresses by default.

Step-by-Step Solution

1
Identify the requirement for SQL Server Agent support.
Only SQL Server on Azure Virtual Machines and Azure SQL Managed Instance support this feature natively.
Azure SQL Database single database and elastic pools do not support SQL Server Agent natively.
2
Identify the requirement for private IP address deployment within a VNet.
Both SQL Server on Azure Virtual Machines and Azure SQL Managed Instance are deployed inside an Azure Virtual Network.
Azure SQL Database single database and elastic pools are logical services hosted on public endpoints by default.

Key Concept

Selecting the appropriate Azure SQL relational database service based on feature compatibility and network isolation requirements.
Question 106Question →

An enterprise is designing a security and subscription governance strategy for its Azure environment. Which two of the following configurations align with Microsoft best practices for scalable access control and the principle of least privilege?

Select all that apply

Show answer & explanation

Answer: Create Microsoft Entra ID groups for administrative functions and assign the required Azure RBAC roles to these groups.; Configure Microsoft Entra Privileged Identity Management (PIM) role assignments as eligible rather than permanently active.

Answer

The correct configurations are to assign Azure RBAC roles to Microsoft Entra ID groups instead of individual users, and to configure Microsoft Entra Privileged Identity Management (PIM) role assignments as eligible instead of permanently active.
Assigning roles to Microsoft Entra ID groups instead of individual users simplifies administration and ensures scalability. Using Privileged Identity Management (PIM) with eligible assignments enforces the principle of least privilege through just-in-time access control, requiring activation rather than granting standing privileges.

Step-by-Step Solution

1
Evaluate the scalability of assigning RBAC roles to users versus groups.
Assigning roles to Microsoft Entra ID groups reduces administrative overhead and ensures scalability as team members change.
Direct user assignments violate identity governance best practices and make access management difficult to audit and maintain.
2
Analyze the access duration and eligibility configuration for highly privileged roles.
Configuring PIM assignments as eligible ensures users must request activation to obtain permissions, adhering to just-in-time access.
Permanently active assignments violate the principle of least privilege by leaving privileged access continuously enabled.

Key Concept

Azure RBAC Group Assignment and PIM Just-In-Time Access
Question 107Question →

An enterprise is designing a secure identity governance strategy for its cloud administration team. The strategy must satisfy the following requirements:
- Administrators must only hold highly privileged directory roles on a temporary, just-in-time (JIT) basis.
- When administrators activate and use these roles, they must be prompted for multi-factor authentication (MFA) and must connect from a compliant device.
- The design must guarantee that the organization does not lose administrative access to the Microsoft Entra tenant if a widespread multi-factor authentication outage or device compliance system failure occurs.
- On-premises infrastructure footprint and configuration complexity must be minimized.

Which design should you recommend?

Show answer & explanation

Answer: Configure eligible assignments in Microsoft Entra Privileged Identity Management (PIM) for the administrative roles. Create a Microsoft Entra Conditional Access policy that targets these directory roles and requires MFA and device compliance, and explicitly exclude a designated, cloud-only emergency access account from this policy.

Answer

Configure eligible assignments in Microsoft Entra Privileged Identity Management (PIM) for administrative roles, enforce MFA and device compliance with a Microsoft Entra Conditional Access policy targeting those roles, and exclude a cloud-only emergency access account from the policy.
The correct design uses Microsoft Entra PIM with eligible assignments to enforce just-in-time administrative access, applies a Conditional Access policy to target directory roles for MFA and compliant devices, and excludes an emergency access account to prevent lockout. This achieves high security and business continuity with zero on-premises footprint.

Step-by-Step Solution

1
Evaluate the just-in-time (JIT) requirement.
Determine that Microsoft Entra Privileged Identity Management (PIM) must be used with eligible assignments.
Eligible assignments require administrators to explicitly activate their roles when needed rather than holding privileges permanently, satisfying JIT requirements.
2
Address the multi-factor authentication (MFA) and device compliance requirements for privileged sessions.
Design a Microsoft Entra Conditional Access policy that triggers when directory roles are active and enforces MFA and device compliance.
Conditional Access policies can target specific directory roles, ensuring that elevated privileges are protected by strong authentication and device health checks.
3
Design resilience against authentication service outages and tenant lockouts.
Create a designated, cloud-only emergency access (break-glass) account and exclude it from the Conditional Access policy.
Excluding the emergency access account ensures that administrators can still log in using standard credentials to resolve configuration or authentication provider issues if Entra ID MFA or compliance services fail.
4
Minimize on-premises infrastructure footprint and complexity.
Select cloud-native identity controls instead of deploying federated authentication via AD FS.
AD FS requires on-premises server infrastructure, security certificates, and management overhead, whereas Microsoft Entra ID cloud-native features meet all requirements natively.

Key Concept

Designing secure, resilient administrative access by combining Microsoft Entra PIM, Conditional Access, and emergency exclusion practices.
Estimated Time:2m 30s
Question 108Question →

You are designing a privileged access solution for a team of support staff who require temporary, time-bound access to administrative roles in Azure. You also need to configure a tenant-wide emergency access (break-glass) account. Which configuration should you recommend to ensure secure administrative access and prevent tenant lockout?

Show answer & explanation

Answer: Configure the administrative roles as eligible for a Microsoft Entra ID security group containing the support staff, and exclude the emergency access account from Conditional Access policies requiring Multi-Factor Authentication (MFA).

Answer

Configure the administrative roles as eligible for a Microsoft Entra ID security group containing the support staff, and exclude the emergency access account from Conditional Access policies requiring Multi-Factor Authentication (MFA).
The correct option combines three Microsoft Entra governance best practices. First, using eligible assignments ensures that support staff must activate their roles only when needed, minimizing the risk of compromised standing privileges. Second, assigning administrative roles to a security group rather than individuals aligns with group-based access control guidelines, reducing administrative overhead. Third, excluding the break-glass/emergency access account from MFA ensures that administrators can still access the tenant in the event of an MFA infrastructure failure.

Step-by-Step Solution

1
Select the correct role assignment type in Microsoft Entra Privileged Identity Management (PIM).
Use 'eligible' role assignments instead of 'active' assignments to enforce just-in-time (JIT) access.
Active assignments grant standing privileges, whereas eligible assignments require users to perform activation steps only when access is needed.
2
Determine the identity structure for role assignments.
Assign the roles to a Microsoft Entra ID security group containing the users rather than to individual user accounts.
Group-based role assignment simplifies administration, aligns with RBAC best practices, and allows membership changes to govern role access automatically.
3
Apply Conditional Access policies for the emergency access account.
Exclude the emergency (break-glass) account from policies that enforce Multi-Factor Authentication (MFA).
Emergency accounts must remain accessible during MFA service outages or disaster recovery scenarios where standard administrators cannot log in.

Key Concept

Best practices for Microsoft Entra Privileged Identity Management (PIM) role assignments and emergency access governance.
Estimated Time:1m 0s
Question 109Question →

Apex Orion Logistics is designing a hybrid identity and multi-tenant access solution to integrate their on-premises Active Directory Domain Services (AD DS) forest, apex-orion.internal (containing 8,400 users), with a new Microsoft Entra ID tenant. The design must satisfy the following constraints:
- Authentication: Users must log in to cloud resources using their on-premises credentials. Under normal conditions, password validation must occur on-premises, and passwords or password hashes must not be stored in the cloud.
- Business Continuity: The authentication solution must support an automated standby mechanism that allows cloud logins to succeed even if the on-premises domain controllers or network connections become completely unavailable.
- Self-Service: Hybrid users must be able to reset their own passwords using self-service password reset (SSPR) in the cloud, and the changes must immediately update the on-premises AD DS.
- External Collaboration: Users from partner organizations who use their own Microsoft Entra ID tenants must be able to access internal resources securely, governed by granular inbound and outbound trust policies.

Match each business or technical requirement of the Apex Orion Logistics hybrid architecture to the most appropriate Microsoft Entra ID feature.

Click a left item, then click its matching right item

Items

The primary authentication mechanism that validates credentials directly against on-premises domain controllers without storing passwords or password hashes in the cloud.
The secondary authentication mechanism configured as a standby backup to ensure users can log in to cloud resources if the on-premises infrastructure goes offline.
The synchronization feature required to write back password updates made via the Microsoft Entra ID self-service password reset (SSPR) portal to the on-premises AD DS.
The configuration used to define granular inbound and outbound trust policies for collaboration with partner Microsoft Entra ID tenants.

Matches

Show answer & explanation

Answer

The correct matches are: The primary authentication mechanism maps to Pass-Through Authentication (PTA); the standby backup authentication mechanism maps to Password Hash Synchronization (PHS); the SSPR writeback capability maps to Password Writeback; and the granular trust policy configuration maps to Cross-Tenant Access Settings.
The correct pairings match each requirement to the optimal hybrid feature: Pass-Through Authentication (PTA) validates passwords on-premises without cloud hash storage; Password Hash Synchronization (PHS) functions as a standby backup for high-availability; Password Writeback synchronizes cloud SSPR changes to on-premises AD DS; and Cross-Tenant Access Settings govern trust boundaries with partner tenants.

Step-by-Step Solution

1
Analyze the primary authentication constraint.
Since password validation must occur on-premises and hashes cannot be stored in the cloud under normal conditions, select Pass-Through Authentication (PTA) as the primary mechanism.
PTA routes authentication requests directly to on-premises agents without cloud storage of passwords or hashes.
2
Analyze the business continuity and failover requirements.
Select Password Hash Synchronization (PHS) as the standby backup.
PHS can be configured alongside PTA, allowing Microsoft Entra ID to fall back to cloud-based hash validation if on-premises agents or domain controllers become unavailable.
3
Analyze self-service and external collaboration constraints.
Select Password Writeback for SSPR synchronization, and Cross-Tenant Access Settings to define trust policies with partner tenants.
Password Writeback updates the local AD DS when users reset passwords in the cloud, while Cross-Tenant Access Settings control trust and access flow with external Entra ID tenants.

Key Concept

Designing a secure hybrid identity infrastructure with high-availability, self-service password capabilities, and multi-tenant access controls.
Question 110Question →

Luminary Financials is designing a hybrid identity solution to integrate their on-premises Active Directory Domain Services (AD DS) forest, corp.luminaryfinancials.com, with a new Microsoft Entra ID tenant. The forest contains approximately 35,000 user accounts.

The solution must meet the following requirements:
- On-premises users must be able to authenticate to cloud resources.
- If the connection between the on-premises network and Azure is lost, users must still be able to authenticate to cloud resources.
- Users must be able to change their passwords in the cloud using self-service password reset (SSPR), and these changes must immediately synchronize back to the on-premises AD DS forest.
- Emergency access accounts must be protected against accidental lockout during tenant-wide Multi-Factor Authentication (MFA) enforcement.

Which two configuration actions should you include in the hybrid identity design? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure Microsoft Entra Connect to use Password Hash Synchronization (PHS).; Enable password writeback in the Microsoft Entra Connect configuration.

Answer

Configure Microsoft Entra Connect to use Password Hash Synchronization (PHS) and enable password writeback in the Microsoft Entra Connect configuration.
The correct configuration combines Password Hash Synchronization (PHS) with enabling password writeback in Microsoft Entra Connect. Password Hash Synchronization ensures that users can authenticate to cloud services using their AD DS credentials even if the on-premises network link is down, as Microsoft Entra ID performs the authentication natively in the cloud. Enabling password writeback is required to allow self-service password reset (SSPR) operations performed in Microsoft Entra ID to propagate back to the on-premises AD DS forest.

Step-by-Step Solution

1
Determine the synchronization and authentication method that satisfies the business continuity requirements during an on-premises network outage.
Password Hash Synchronization (PHS) is selected as the primary sync authentication method.
Unlike PTA or AD FS, PHS enables Microsoft Entra ID to handle user authentication entirely in the cloud, ensuring users can log in even if the on-premises network or domain controllers are unreachable.
2
Enable password writeback within the Microsoft Entra Connect synchronization configuration.
Password writeback is successfully activated.
This allows self-service password reset (SSPR) updates triggered in the cloud to be written back to the on-premises AD DS environment in real time, satisfying the bi-directional password synchronization requirement.

Key Concept

Designing a highly available hybrid identity synchronization and self-service password reset solution.
Estimated Time:2m 0s
Question 111Question →

A company is planning to migrate a legacy on-premises electronic health record (EHR) application to Azure. The relational database for the application has the following requirements:
- Must support SQL Server Agent to run nightly maintenance jobs.
- Must support Database Mail to send automated notifications to administrators.
- Must be deployed into a private, delegated subnet within an Azure Virtual Network.
- In the event of a regional disaster, all database backups must remain available.
- The administrative overhead for managing operating system patching and hardware updates must be minimized.

Which Azure SQL deployment option should you recommend?

Show answer & explanation

Answer: Azure SQL Managed Instance configured with geo-redundant storage (GRS) backups.

Answer

Azure SQL Managed Instance configured with geo-redundant storage (GRS) backups
The option recommending Azure SQL Managed Instance with geo-redundant storage (GRS) backups is correct because it meets all requirements. Azure SQL Managed Instance is a fully managed PaaS service that supports instance-level features such as SQL Server Agent and Database Mail. It runs inside a delegated subnet within a virtual network. Using GRS backups ensures that backups survive a regional disaster while avoiding the administrative overhead of OS patching associated with virtual machines.

Step-by-Step Solution

1
Analyze instance-level requirements
SQL Server Agent and Database Mail are instance-level features, meaning that standard Azure SQL Database (single database or elastic pools) cannot meet these requirements natively.
Azure SQL Database does not support instance-level features like SQL Server Agent or Database Mail.
2
Evaluate administrative overhead constraint
SQL Server on Azure VMs is ruled out because it requires manual OS and database engine patching, failing the constraint to minimize administration.
Choosing a PaaS service is necessary to offload OS and engine maintenance to Microsoft.
3
Determine the service tier
Azure SQL Managed Instance is selected because it is a PaaS service that supports SQL Server Agent, Database Mail, and virtual network integration.
Managed Instance provides near 100% compatibility with the SQL Server database engine along with PaaS benefits.
4
Select backup storage redundancy
Geo-redundant storage (GRS) must be chosen for backups rather than locally redundant storage (LRS).
Only GRS replicates backups to a secondary paired region to survive a primary regional disaster.

Key Concept

Azure SQL service comparison based on legacy feature support, network requirements, and management overhead
Question 112Question →

An organization is planning to migrate an on-premises payroll application to Azure. The application database relies on SQL Server Agent for scheduled data reconciliation and executes cross-database queries. The database must be deployed in a secure environment with native Azure Virtual Network (VNet) integration. To meet disaster recovery requirements, all backups must survive a regional outage, and the database administration team must minimize administrative effort for operating system and database engine patching. Which Azure SQL deployment option should you recommend?

Show answer & explanation

Answer: Azure SQL Managed Instance

Answer

Azure SQL Managed Instance
Azure SQL Managed Instance is the correct recommendation because it provides near-100% compatibility with the on-premises SQL Server database engine, including native support for SQL Server Agent and cross-database queries. As a fully managed Platform as a Service (PaaS), it handles operating system and database engine patching automatically, integrates natively with an Azure Virtual Network, and supports geo-redundant backup storage to ensure backups survive a regional outage.

Step-by-Step Solution

1
Analyze the technical and administrative requirements of the database migration scenario.
Requirements identified: SQL Server Agent support, cross-database query support, native VNet integration, regional backup resiliency (survive regional outage), and minimal administrative overhead (PaaS model).
Understanding constraints is necessary to filter out non-compliant Azure database services.
2
Evaluate the management overhead (IaaS vs. PaaS) requirement.
SQL Server on Azure Virtual Machines is eliminated because it is an IaaS solution requiring the administration team to manage operating system and database patching.
The organization specified a need to minimize administrative patching efforts.
3
Compare PaaS options against legacy database feature and backup requirements.
Azure SQL Database (both single database and elastic pool configurations) is eliminated because it lacks native support for SQL Server Agent and cross-database queries. Additionally, choosing locally redundant storage (LRS) fails the requirement for regional resilience.
Selecting a service tier that lacks native support for required legacy features would lead to deployment failure or complex, unmanageable workarounds.

Key Concept

Selecting the appropriate Azure SQL deployment option based on legacy feature support, network requirements, and administrative overhead.
Question 113Question →

A startup is deploying a new web application that requires a relational database to store user profiles. The database will run as a standalone database and has no requirements for instance-level features such as SQL Server Agent, cross-database queries, or Common Language Runtime (CLR). The startup requires a fully managed solution that minimizes administrative effort and overhead. Which Azure SQL deployment option should you recommend?

Show answer & explanation

Answer: Azure SQL Database single database

Answer

Azure SQL Database single database
The correct option is the single database deployment of Azure SQL Database. This PaaS offering provides a fully managed database solution with built-in high availability, backups, and updates, ensuring minimal administrative overhead. Because the scenario specifies a standalone database with no need for instance-level features, this option is the most efficient and simple fit.

Step-by-Step Solution

1
Analyze the requirements for the database deployment.
The requirements specify a standalone relational database, fully managed to minimize administrative overhead, and with no dependencies on instance-level features (like SQL Server Agent, cross-database queries, or CLR).
This helps narrow down the choices between IaaS (Virtual Machines) and PaaS (Single Database, Elastic Pool, Managed Instance).
2
Evaluate the management overhead of the options.
SQL Server on Azure VMs requires managing the operating system and SQL Server instance, which introduces high administrative overhead. Fully managed options (Azure SQL Database and Azure SQL Managed Instance) eliminate this overhead.
This rules out the Infrastructure as a Service (IaaS) option.
3
Evaluate the database-level vs. instance-level requirements.
Azure SQL Managed Instance is designed for applications requiring instance-level features. Since there are no instance-level dependencies (no SQL Agent, no CLR, no cross-database queries) and it is a standalone database, Azure SQL Database single database is the most appropriate and cost-effective fully managed option.
This distinguishes between the single database and Managed Instance/elastic pool options.

Key Concept

Azure SQL deployment options selection based on application requirements and administrative overhead constraints.
Question 114Question →

An organization is designing the relational database tier for a new multi-tenant software-as-a-service (SaaS) application in Azure. The design must meet the following requirements:
- Host 80 separate databases, one for each tenant, to ensure data isolation.
- Manage unpredictable workload spikes dynamically across all databases by sharing a single pool of compute resources.
- Run scheduled administrative queries and schema updates across all databases without managing virtual machines, operating systems, or configuring individual database connections.
- Minimize overall monthly costs.

Which two Azure SQL options or features should you recommend?

Select all that apply

Show answer & explanation

Answer: Azure SQL Database Elastic Pools; Elastic Database Jobs

Answer

The correct recommendations are Azure SQL Database Elastic Pools to share compute resources dynamically, and Elastic Database Jobs to execute scheduled administrative queries across all tenant databases without managing infrastructure.
The correct options are Azure SQL Database Elastic Pools and Elastic Database Jobs. Azure SQL Database Elastic Pools allow multiple databases with unpredictable workloads to share a pre-allocated pool of compute resources, optimizing costs. Elastic Database Jobs allow running T-SQL queries and administrative tasks across all databases in an Elastic Pool simultaneously without managing underlying servers or virtual machines.

Step-by-Step Solution

1
Analyze the tenant database and resource sharing requirements.
Since there are 80 databases with unpredictable workload spikes that must share a single pool of compute resources to minimize costs, Azure SQL Database Elastic Pools is the most cost-effective and suitable fit.
Elastic Pools allow databases to share a set budget of DTUs or vCores rather than paying for peak capacity individually.
2
Analyze the administrative scheduling and query execution requirements.
To execute queries across all 80 databases without managing VMs, operating systems, or configuring individual connections, Elastic Database Jobs should be used.
Elastic Database Jobs is a native, serverless job scheduling agent designed specifically to run T-SQL scripts against groups of databases in Azure SQL Database.
3
Evaluate alternative options against constraints.
Managed Instance and SQL Server on Azure VMs are rejected due to high baseline costs, administrative overhead, and the requirement to avoid managing virtual machines or operating systems.
SQL Server on Azure VMs introduces operating system patching overhead. Azure SQL Managed Instance lacks the elastic resource sharing capabilities of Elastic Pools at a low cost point.

Key Concept

Azure SQL Database Elastic Pools provide resource sharing for multi-tenant databases, while Elastic Database Jobs enable administrative task automation across database groups without infrastructure overhead.
Question 115Question →

Vortex Cloud Solutions has an on-premises Active Directory Domain Services (AD DS) forest named internal.vortexcloud.net with 5,800 users. You are designing a hybrid identity and security solution to integrate the on-premises forest with a new Microsoft Entra ID tenant.

The solution must satisfy the following requirements:
- Users must sign in to Microsoft Entra ID using their on-premises credentials.
- If the on-premises domain controllers or network connectivity is lost, users must still be able to authenticate to cloud services using their current passwords.
- Users must be allowed to reset their own passwords in Microsoft Entra ID, and these changes must be reflected immediately in the on-premises AD DS.
- To secure administrative access, a Conditional Access policy must enforce multi-factor authentication (MFA) for all global administrators, while mitigating the risk of tenant lockout during an MFA service outage.
- On-premises infrastructure requirements must be minimized.

Which solution should you recommend?

Show answer & explanation

Answer: Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable password writeback. Create a Conditional Access policy requiring MFA for the Global Administrator role, and exclude two dedicated emergency access accounts from the policy.

Answer

Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable password writeback. Create a Conditional Access policy requiring MFA for the Global Administrator role, and exclude two dedicated emergency access accounts from the policy.
The correct option addresses all design constraints. Password Hash Synchronization (PHS) enables cloud-based authentication of synchronized accounts even if the on-premises network or Active Directory Domain Controllers are offline. Enabling password writeback ensures that changes from Self-Service Password Reset (SSPR) are immediately synchronized back to the on-premises Active Directory. Implementing a Conditional Access policy that enforces MFA for global administrators while excluding emergency access accounts protects the tenant from unauthorized access while mitigating the risk of administrative lockout during an MFA disruption. Finally, PHS minimizes the on-premises footprint compared to PTA and AD FS.

Step-by-Step Solution

1
Evaluate authentication requirements for high availability and offline capability.
Password Hash Synchronization (PHS) is selected because it copies a hash of the user's password hash from on-premises to Microsoft Entra ID. This allows Microsoft Entra ID to authenticate users directly in the cloud, ensuring sign-in capabilities persist even if the on-premises domain controllers or network connections are offline. Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) both require active on-premises infrastructure to perform real-time authentication.
This guarantees business continuity and matches the requirement to allow authentication during on-premises outages.
2
Determine the synchronization mechanism needed for cloud-initiated password resets.
Password writeback must be enabled in Microsoft Entra Connect.
This ensures that when users change or reset their passwords via Microsoft Entra Self-Service Password Reset (SSPR), the change is immediately written back to the on-premises Active Directory Domain Services (AD DS) database.
3
Design the Conditional Access policy and lockout protection for administrative users.
A Conditional Access policy is configured to target the Global Administrator directory role and require MFA. To safeguard the tenant, two dedicated emergency access accounts (break-glass accounts) are created and explicitly excluded from this policy.
This prevents administrative lockout if the multi-factor authentication service is disrupted or misconfigured.

Key Concept

Designing high-availability hybrid identity and secure administration using Password Hash Synchronization, password writeback, and Conditional Access exclusions.
Question 116Question →

Your company has an Azure subscription containing multiple resource groups. You need to grant administrative permissions to three new IT support engineers to manage virtual machines within a specific resource group. The solution must minimize administrative overhead and follow Azure governance best practices.

Which of the following approaches should you implement?

Show answer & explanation

Answer: Create a Microsoft Entra ID group containing the three engineers, and assign the Virtual Machine Contributor role to the group at the resource group scope.

Answer

Create a Microsoft Entra ID group containing the three engineers, and assign the Virtual Machine Contributor role to the group at the resource group scope.
The correct answer is to create a Microsoft Entra ID security group, add the three engineers to the group, and assign the Virtual Machine Contributor role to the group at the resource group scope. This adheres to the Azure governance best practices of group-based access control and the principle of least privilege, while reducing the administrative effort needed to manage access rights.

Step-by-Step Solution

1
Identify the administrative unit to group the users.
Create a Microsoft Entra ID security group and add the three engineers as members.
Grouping users minimizes administrative overhead and enables scalable access management.
2
Determine the appropriate scope for the role assignment.
Assign permissions at the specific resource group scope rather than the subscription scope.
This enforces the principle of least privilege by ensuring access is limited to only the required resources.
3
Apply the appropriate Azure role to the security group.
Assign the Virtual Machine Contributor role to the created Microsoft Entra ID security group at the resource group scope.
This provides the required administrative permissions to manage virtual machines without using custom roles or individual assignments.

Key Concept

Group-based role assignments and least privilege scopes are fundamental to Azure RBAC and subscription governance.
Estimated Time:45s
Question 117Question →

An enterprise is designing a governance and identity strategy for its multi-subscription Azure environment. The environment is organized under a single management group hierarchy with separate production and non-production management groups.

The strategy must meet the following requirements:
- A security audit team must be able to view all resource configurations and compliance logs across all subscriptions.
- The database administration team requires permissions to manage Azure SQL databases across all subscriptions, but these permissions must only be active during approved maintenance windows.
- All administrative privileges must scale efficiently as employees join or leave the organization.

Which of the following configurations should you include in the design to meet these requirements while following the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Microsoft Entra ID group for the security audit team, and assign the Reader role to this group at the root management group level.; Configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make a database administration group eligible for the SQL Server Contributor role assigned at the root management group level.

Answer

Create a Microsoft Entra ID group for the security audit team, and assign the Reader role to this group at the root management group level; and configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make a database administration group eligible for the SQL Server Contributor role assigned at the root management group level.
The correct options implement scalable, group-based, and least-privilege governance. Creating a Microsoft Entra ID group and assigning the Reader role at the root management group level ensures all nested subscriptions inherit the permission, satisfying the auditing requirement with minimal overhead. Making the database administration group eligible for the SQL Server Contributor role via PIM for Groups provides just-in-time (JIT) access, ensuring that administrative privileges are active only during maintenance windows.

Step-by-Step Solution

1
Analyze the access requirement for the security audit team.
Identify that the team needs read-only access (Reader role) across all subscriptions, which should be assigned to a group at the root management group level to ensure inheritance and reduce administrative overhead.
This satisfies the view-only and scalability requirements efficiently without directly assigning roles to individual users.
2
Analyze the access requirement for the database administration team.
Identify that SQL database management is required, but it must be time-bound (just-in-time access). Configure Privileged Identity Management (PIM) for Groups to make the group eligible for the SQL Server Contributor role at the root management group level.
This ensures access is not permanently active, satisfying the principle of least privilege and approved maintenance window constraint.
3
Evaluate the distractors against Azure governance best practices.
Discard direct user assignments, permanent active role configurations for JIT requirements, and inappropriate Azure Policy effects for identity lifecycle management.
Direct assignments violate scalability, permanent assignments violate least privilege, and Azure Policy is not an identity lifecycle management tool.

Key Concept

Azure RBAC inheritance and Privileged Identity Management (PIM) for group-based governance.
Question 118Question →

An enterprise is designing an Azure governance solution. The security team mandates that all Azure Key Vaults in the production subscriptions must have diagnostic settings configured to send logs to a central Log Analytics workspace. The solution must ensure that when developers create new Key Vaults, the diagnostic settings are automatically created if they are missing, without preventing the creation of the Key Vaults. Which Azure Policy effect should you recommend in the policy design to meet these requirements?

Show answer & explanation

Answer: DeployIfNotExists

Answer

DeployIfNotExists
The DeployIfNotExists effect is the correct choice because diagnostic settings are distinct child resources (Microsoft.Insights/diagnosticSettings) associated with the Key Vault. DeployIfNotExists enables Azure Policy to automatically deploy these missing child resources without preventing developers from creating the Key Vaults.

Step-by-Step Solution

1
Analyze the target resource and governance requirement.
Diagnostic settings are child resources of the Key Vault (type Microsoft.Insights/diagnosticSettings) rather than properties on the Key Vault resource itself.
This helps distinguish between effects that alter resource properties (like Modify) and effects that deploy child resources.
2
Evaluate the deployment constraints.
The requirement states that the policy must not prevent the creation of Key Vaults.
This rules out the Deny effect, which would block the deployment of any non-compliant Key Vault.
3
Select the correct effect that performs remediation for child resources.
DeployIfNotExists checks for the existence of the child resource and automatically deploys it using a template if it is missing, while allowing the parent resource deployment to succeed.
Only DeployIfNotExists supports the automatic deployment of dependent child resources like diagnostic settings without blocking the primary resource creation.

Key Concept

Azure Policy effects dictate what action Azure takes when a resource is evaluated. DeployIfNotExists is used to remediate non-compliant resources by deploying nested or child resources, whereas Modify alters properties on the resource itself.
Estimated Time:1m 30s
Question 119Question →

An organization is designing a hybrid identity, access, and governance solution for their Microsoft Entra ID tenant. The organization currently uses an on-premises Active Directory Domain Services (AD DS) directory and plans to synchronize identities to Entra ID. The solution must satisfy the following design requirements:
- Minimize the on-premises infrastructure footprint and runtime dependencies required for user authentication.
- Enable users to authenticate directly in the cloud.
- Enforce time-bound, just-in-time access for administrative roles using Microsoft Entra Privileged Identity Management (PIM).
- Enforce Multi-Factor Authentication (MFA) via Conditional Access for administrative roles while ensuring that the organization can always access the tenant in the event of a service outage or configuration error.

Which two of the following components should you include in the identity and access design? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) to handle user authentication in the cloud.; Configure role assignments for administrative users as Eligible within Microsoft Entra Privileged Identity Management (PIM).

Answer

The correct components to include are configuring Microsoft Entra Connect with Password Hash Synchronization (PHS) for hybrid authentication and setting administrative role assignments as Eligible in Privileged Identity Management (PIM).
The design correctly selects Password Hash Synchronization (PHS) because it authenticates users directly in the cloud and has the lowest on-premises infrastructure footprint. Additionally, configuring PIM role assignments as Eligible ensures that administrators only obtain privileges when required and justified (just-in-time), rather than holding them permanently.

Step-by-Step Solution

1
Analyze the hybrid identity requirements to choose the correct authentication method.
Password Hash Synchronization (PHS) is selected because it enables direct cloud authentication and requires minimal on-premises infrastructure, unlike AD FS which requires a large federation server footprint.
This satisfies the requirement to minimize on-premises infrastructure and authenticate directly in the cloud.
2
Evaluate administrative access requirements to select the appropriate Privileged Identity Management (PIM) configuration.
Administrative role assignments must be configured as 'Eligible' rather than permanently 'Active'.
This ensures users only receive privileged access just-in-time and for a limited duration, fulfilling the least-privileged access requirement.
3
Design the Conditional Access policy to enforce multi-factor authentication (MFA) safely.
Exclude emergency access (glass-breaker) accounts from the Conditional Access MFA policy.
This prevents administrative lockout in case of tenant-wide MFA issues or policy misconfigurations, ensuring emergency access is always available.
4
Synthesize the architecture choices to identify the correct design components.
Select the options recommending PHS and Eligible PIM assignments, while avoiding options proposing AD FS, permanently active PIM roles, or zero-exclusion MFA policies.
This integrates the selected authentication, privilege governance, and recovery components into a compliant design.

Key Concept

Microsoft Entra ID hybrid authentication methods, Privileged Identity Management (PIM) role configurations, and Conditional Access exclusion planning.
Estimated Time:3m 0s
Question 120Question →

A financial services firm is designing its hybrid identity infrastructure using Microsoft Entra ID. The firm has an on-premises Active Directory Domain Services (AD DS) environment and requires a secure, resilient access management design. Which Microsoft Entra ID authentication methods and Conditional Access features should you select to meet each business and security requirement?

Click a left item, then click its matching right item

Items

Validate user authentication directly against on-premises Active Directory in real-time, ensuring that no password representations or hashes are stored in the cloud under any circumstances.
Ensure that users can authenticate to cloud resources using their domain credentials even during a complete WAN outage that isolates the on-premises domain controllers.
Require external consultants accessing a specific project portal to re-authenticate every 8 hours and enforce access only from devices registered as compliant in Microsoft Intune.
Enforce multi-factor authentication (MFA) only when Entra ID detects anomalous behavior associated with the specific sign-in attempt, such as access from an unfamiliar IP address.

Matches

Show answer & explanation

Answer

Validate on-premises in real-time matches Microsoft Entra Pass-through Authentication (PTA). Authenticate during WAN outage matches Microsoft Entra Password Hash Synchronization (PHS). Re-authenticate every 8 hours and compliant device matches Conditional Access session controls and grant controls. MFA on anomalous sign-in attempts matches Conditional Access sign-in risk policy.
Pass-through Authentication (PTA) routes user authentication requests directly to on-premises Active Directory domain controllers via local agents, keeping all password hashes out of Microsoft Entra ID. Password Hash Synchronization (PHS) syncs password hashes to the cloud, enabling cloud-based authentication even if the on-premises network or agents are down. Conditional Access session controls manage session lifetimes (like sign-in frequency), and grant controls enforce specific rules (like requiring compliant devices). Conditional Access sign-in risk policies detect session-specific anomalies, such as an unfamiliar IP address or location, during authentication.

Step-by-Step Solution

1
Analyze the real-time on-premises validation requirement.
Identify that Pass-through Authentication (PTA) passes the authentication request to local agents without storing any credentials in the cloud, fulfilling the zero-cloud-hash constraint.
To satisfy security policies that prohibit cloud storage of password hashes.
2
Evaluate the offline resilience requirement.
Identify that Password Hash Synchronization (PHS) synchronizes password hashes to the cloud, allowing Entra ID to authenticate users independently of the on-premises infrastructure status.
To ensure business continuity during an on-premises network or domain controller outage.
3
Determine the features needed for session limit and device compliance.
Determine that sign-in frequency (session controls) handles the 8-hour limit, and compliant device checks (grant controls) enforce the MDM requirement.
To combine session lifetime configuration with device-state verification using Conditional Access.
4
Assess the anomalous sign-in requirement.
Identify that sign-in risk policies evaluate anomalies for a specific authentication session (like atypical location), whereas user risk policies evaluate overall credential compromise likelihood.
To target session-specific anomalies dynamically during authentication.

Key Concept

Selecting hybrid authentication methods and designing Conditional Access policies based on security, availability, and session requirements.
Estimated Time:2m 30s
PreviousPage 6 / 60Next
All practice questions — Microsoft Azure Solutions Architect (AZ-305) | Examkin