A company wants to implement just-in-time (JIT) access for administrative roles in Azure AD and also ensure that privileged role activations are approved by a manager. They want to minimize standing access. What should you do?

Use Azure AD Privileged Identity Management (PIM) to configure role assignments as eligible, require approval for activation, and set a maximum activation duration.

Use Azure AD access reviews to periodically remove unused privileged roles, but keep roles permanently assigned.

Use Azure AD Identity Protection to detect risky sign-ins and block them, but do not manage role assignments.

Use conditional access policies to require multi-factor authentication for privileged roles, but do not change role assignments.

Contoso Ltd. is a global company with three business units: Retail, Manufacturing, and Finance. Each business unit has its own IT team that manages its own Azure resources and wants to enforce its own compliance policies (e.g., Retail requires specific data-residency tags, Finance requires stricter network controls). The company also wants to apply a common baseline policy (e.g., prohibit public IPs on VMs) across all subscriptions. You need to design a management group hierarchy that supports these requirements with minimal administrative overhead. What should you do?

Create a single management group for Contoso and place all subscriptions under it. Apply all policies (common and business-unit-specific) at this single management group, using tags to differentiate business units.

Create a management group for each business unit, but place all subscriptions directly under the root management group. Apply common policies at the root and business-unit policies at the business-unit management groups.

Create a root management group for Contoso, then create a child management group for each business unit. Place each business unit's subscriptions under its respective child management group. Apply the common baseline policy at the root and business-unit-specific policies at the child management groups.

Create a management group per subscription, then group these under a root management group. Apply common policies at the root and business-unit policies on each subscription's management group.

A company is acquiring a smaller company and needs to integrate its Azure subscriptions into the existing management group hierarchy. The acquired company has its own compliance requirements (e.g., local data residency) that differ from the parent company. You need to ensure that the acquired company's subscriptions inherit the parent company's baseline policies but also allow the acquired company to manage its own compliance policies. What should you do?

Create a separate management group hierarchy for the acquired company, not connected to the parent's root.

Create a new management group under the root for the acquired company, move its subscriptions under that management group, and assign the parent's baseline policies at the root and the acquired company's policies at the new management group.

Move the acquired company's subscriptions directly under the root management group and assign all policies (parent and acquired) at the root.

Place the acquired company's subscriptions in the same management groups as the parent's subscriptions, and use tags to differentiate them.

A company is required to retain audit logs for a certain period (e.g., 7 years) for compliance. They are using Azure Policy to audit resource configurations and Azure Activity Logs to track administrative actions. They want to ensure that the logs are retained for the required period and are tamper-proof. What should they do?

Stream Azure Activity Logs and policy compliance data to a Log Analytics workspace, and configure the workspace retention to 7 years. Enable Azure Defender for Cloud to protect the workspace.

Use Azure Monitor to collect logs and store them in a Log Analytics workspace, and rely on the workspace's default retention of 30 days.

Export Azure Activity Logs and policy compliance data to an Azure Storage account with immutable storage (WORM) policy, and set the retention to 7 years.

Use Azure Policy to audit logs and store them in a storage account, but do not enable any retention or immutability settings.

Azure Solutions Architect Expert

Domain 1Objective 3

Design Governance AZ-305 Practice Questions (Page 5)

Part of the Design identity, governance, and monitoring solutions domain, which makes up ~30% of our current practice bank. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 21–25

21application · medium
A company wants to implement just-in-time (JIT) access for administrative roles in Azure AD and also ensure that privileged role activations are approved by a manager. They want to minimize standing access. What should you do?
Select an answer first
22application · medium
Contoso Ltd. is a global company with three business units: Retail, Manufacturing, and Finance. Each business unit has its own IT team that manages its own Azure resources and wants to enforce its own compliance policies (e.g., Retail requires specific data-residency tags, Finance requires stricter network controls). The company also wants to apply a common baseline policy (e.g., prohibit public IPs on VMs) across all subscriptions. You need to design a management group hierarchy that supports these requirements with minimal administrative overhead. What should you do?
Select an answer first
23application · medium
A company is acquiring a smaller company and needs to integrate its Azure subscriptions into the existing management group hierarchy. The acquired company has its own compliance requirements (e.g., local data residency) that differ from the parent company. You need to ensure that the acquired company's subscriptions inherit the parent company's baseline policies but also allow the acquired company to manage its own compliance policies. What should you do?
Select an answer first
24expert · hard
A company is required to retain audit logs for a certain period (e.g., 7 years) for compliance. They are using Azure Policy to audit resource configurations and Azure Activity Logs to track administrative actions. They want to ensure that the logs are retained for the required period and are tamper-proof. What should they do?
Select an answer first
25foundation · easy
Which Azure service provides pre-built policy and initiative definitions to help assess compliance with common regulatory standards?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-305

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-305” is a trademark of its owner, used for identification only.

Design Governance AZ-305 Practice Questions (Page 5)

Questions 21–25

A company wants to implement just-in-time (JIT) access for administrative roles in Azure AD and also ensure that privileged role activations are approved by a manager. They want to minimize standing access. What should you do?

Which Azure service provides pre-built policy and initiative definitions to help assess compliance with common regulatory standards?

Keep studying — Design identity, governance, and monitoring solutions