SaveMyCert
Log in
5 of 5 free questions left today·for 10 a day
AZ-305 · Domain 1

Design identity, governance, and monitoring solutions practice questions

Design identity, governance, and monitoring solutions is worth 28% of the AZ-305 exam — the 2nd-heaviest of the 4 domains. Designing logging and monitoring (Azure Monitor, Log Analytics, log routing), authentication, identity management and authorization for Azure and on-premises resources, secrets, certificates and keys, and governance: management groups, subscriptions, resource groups, tagging, compliance and identity governance. Official weighting 25–30%. 6 fully worked examples are further down this page, answers included.

Exam weight
28%
the 2nd-heaviest of the 4 domains
Questions
135
across 3 topics
Free, no account
5/day
a free account allows 10 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 4 domains, in Learn mode.

Review what you missed

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Design identity, governance, and monitoring solutions questions, fully explained

Questions from the AZ-305 bank mapped to domain 1, with the answer key and the reasoning behind every option. None of them repeat the examples on the main AZ-305 practice page.

Question 1Design identity, governance, and monitoring solutions

A company sends logs from all subscriptions to one Log Analytics workspace. Application teams already hold the Reader role on their own resource groups and must be able to query the logs of those resources only. The central operations team needs every log in the workspace. You need to minimize administrative effort. What should you recommend for the application teams?

Choose one.

  • a
    Set 'Require workspace permissions' and give each team Log Analytics Reader on the workspace

    Log Analytics Reader on the workspace exposes every table and every resource's data, which breaks the 'their resources only' requirement.

  • b
    Create a separate Log Analytics workspace for each team and point its resources at it

    Separate workspaces would work but add the most administrative effort and split the operations team's view.

  • c
    Keep the 'Use resource or workspace permissions' mode and rely on their resource access Correct

    In this default mode, a user with read access to a resource can query that resource's logs in resource context, with no workspace role to manage.

  • d
    Assign each team a custom role with table-level read on the tables their resources write to

    Table-level RBAC is per table, not per resource; teams would see other teams' rows in the same tables.

The concept

Resource-context RBAC lets users query the logs of resources they can read, without explicit workspace permissions.

Why that’s the answer

With the access control mode 'Use resource or workspace permissions' (the default), a user who has read access to an Azure resource inherits access to that resource's data in the workspace when querying in resource context. The application teams already have Reader, so nothing new needs to be assigned, while the operations team gets workspace-level access. 'Require workspace permissions' with Log Analytics Reader exposes all data. Table-level RBAC can't separate rows from different resources in the same table, and per-team workspaces add effort.

How to reason it out
  1. Note that the boundary is 'their resources', not 'certain tables'.
  2. Resource-context RBAC follows the user's existing permissions on resources.
  3. Keep the default access mode so those permissions apply, and grant workspace access only to the central team.

Exam tip: 'Only the logs of my resources' = resource-context RBAC in the default access mode.

AZ-305 Logging and Monitoring Design: Log Analytics Workspaces, Log Routing, Alerts and Azure Monitor — the lesson that teaches this.

Question 2Design identity, governance, and monitoring solutions

A security team and an operations team share one Log Analytics workspace to reach a commitment tier. Resource owners must keep querying the logs of their own resources without workspace roles. Internal auditors must be able to read only the SigninLogs and AuditLogs tables across the whole workspace, and no other table. You need to keep a single copy of the data. Which TWO actions should you recommend? (Select TWO.)

Choose TWO.

  • a
    Grant the auditors table-level read on SigninLogs and AuditLogs Correct

    Table-level RBAC grants read on specific tables across the workspace, which is exactly the auditors' scope.

  • b
    Change the access mode to 'Require workspace permissions'

    This mode removes resource-context access, so resource owners would lose their logs unless they got workspace roles.

  • c
    Grant the auditors read on the workspace with Log Analytics Reader

    Log Analytics Reader at workspace scope reads every table, which breaks the 'no other table' requirement.

  • d
    Route SigninLogs and AuditLogs to a second workspace for auditors

    A second destination duplicates the sign-in and audit data and its cost, which breaks the single-copy requirement.

  • e
    Leave the access mode at 'Use resource or workspace permissions' Correct

    This mode keeps resource-context access working, so resource owners query their own resources' logs without workspace roles.

The concept

Resource-context RBAC and table-level RBAC combine in one workspace to give different groups different slices of data.

Why that’s the answer

Two different access needs are combined in one workspace. Resource owners need resource-context access, which only works while the access control mode is 'Use resource or workspace permissions'. Auditors need two named tables across all resources, which is what table-level RBAC grants. Switching to 'Require workspace permissions' breaks the resource owners, Log Analytics Reader over-grants the auditors, and a second workspace duplicates data the stem says to keep once.

How to reason it out
  1. Separate the two access needs: per-resource for owners, per-table for auditors.
  2. Per-resource access needs the default access mode, so keep it.
  3. Per-table access across the workspace is table-level RBAC.
  4. Reject options that over-grant or duplicate data.

Exam tip: Per-resource access = resource-context RBAC; per-table access = table-level RBAC; both work in one workspace.

AZ-305 Logging and Monitoring Design: Log Analytics Workspaces, Log Routing, Alerts and Azure Monitor — the lesson that teaches this.

Question 3Design identity, governance, and monitoring solutions

A company ingests large volumes of verbose debug logs from a custom application into a DCR-based custom table. The logs are queried a few times a year during audits, slow queries are acceptable, and no alerts or Insights use them. The company wants the lowest ingestion cost while keeping the data in the workspace. Which table plan should you recommend?

Choose one.

  • a
    The Basic table plan

    Basic reduces ingestion cost and keeps queries fast, but costs more to ingest than Auxiliary, and fast queries aren't needed.

  • b
    The Auxiliary table plan Correct

    Auxiliary has the minimal ingestion price and suits low-touch audit data where slower queries are acceptable.

  • c
    The Analytics table plan

    Analytics has the standard (highest) ingestion price and features such as Insights that this data doesn't use.

  • d
    The Analytics plan with a commitment tier

    A commitment tier discounts Analytics ingestion, but it's still more expensive than a low-cost plan for rarely used data.

The concept

Table plans trade features and query speed for ingestion cost: Analytics, then Basic, then Auxiliary.

Why that’s the answer

The deciding facts are rare queries, slow queries acceptable, no alerts and lowest ingestion cost. The Auxiliary plan is built for low-touch data such as verbose logs and audit data: minimal ingestion cost, queries charged separately and slower. Basic is the middle tier for troubleshooting data that still needs reasonably fast queries. Analytics, with or without a commitment tier, is priced for high-value data used continuously.

How to reason it out
  1. Note how often the data is queried and whether alerts or Insights need it.
  2. Rank the plans by ingestion cost: Analytics > Basic > Auxiliary.
  3. Pick the cheapest plan whose limits the workload accepts.

Exam tip: Rarely queried, slow is fine, no alerts: Auxiliary plan.

AZ-305 Logging and Monitoring Design: Log Analytics Workspaces, Log Routing, Alerts and Azure Monitor — the lesson that teaches this.

Question 4Design identity, governance, and monitoring solutions

An operations team collects container logs that it queries during incident response, so queries must return quickly. The team wants an alert to fire for each row that contains a specific fatal error, and it doesn't use Insights on this data. It wants to cut ingestion cost compared with today. Which table plan should you recommend for the container log table?

Choose one.

  • a
    Auxiliary, with a simple log search alert on the fatal error

    Auxiliary queries are slower and not optimized for real-time analysis, and Auxiliary tables don't support alerts.

  • b
    Basic, with a simple log search alert on the fatal error Correct

    Basic cuts ingestion cost, keeps optimized query performance and supports simple log alerts that evaluate each row.

  • c
    Analytics, with a log search alert on the fatal error

    Analytics supports everything but keeps today's standard ingestion price, so it doesn't cut cost.

  • d
    Analytics, with two years of analytics retention set on the table

    Longer analytics retention adds cost and doesn't address the requirement to reduce ingestion charges.

The concept

The Basic plan sits between Analytics and Auxiliary: reduced ingestion, fast queries, simple log alerts.

Why that’s the answer

The requirements are fast queries, a per-row alert and lower ingestion cost. Basic has a reduced ingestion price, keeps optimized query performance and supports simple log alerts, which evaluate each row individually. Auxiliary is cheaper still but slow and doesn't support alerts. Analytics meets the features but not the cost goal.

How to reason it out
  1. List the must-haves: fast queries, per-row alert, lower ingestion cost.
  2. Eliminate Analytics on cost and Auxiliary on speed and alerting.
  3. Basic remains: reduced cost, optimized queries, simple log alerts.

Exam tip: Needs fast queries and a simple alert at lower cost: Basic plan.

AZ-305 Logging and Monitoring Design: Log Analytics Workspaces, Log Routing, Alerts and Azure Monitor — the lesson that teaches this.

Question 5Design identity, governance, and monitoring solutions

A partner SIEM must receive a high-volume custom table through a Log Analytics data export rule to Event Hubs. The workspace uses workspace replication to a secondary region, and this table must be protected by it. Analysts query the table rarely. You need the lowest ingestion cost that still meets both requirements. Which table plan should you recommend?

Choose one.

  • a
    The Auxiliary table plan

    Auxiliary is cheapest to ingest, but data export rules don't support it and workspace replication doesn't replicate it.

  • b
    The Analytics table plan

    Analytics supports export and replication, but it has the standard ingestion price, not the lowest one that works.

  • c
    The Basic table plan Correct

    Basic is cheaper to ingest than Analytics, and both data export rules and workspace replication support it.

  • d
    The Auxiliary plan, sent to Event Hubs with an export job

    Export jobs don't support the Auxiliary plan either, and the table still wouldn't be replicated to the secondary region.

The concept

Table plans differ in which features they support, not only in price: Auxiliary loses data export and workspace replication.

Why that’s the answer

Two features decide this: the data export rule and workspace replication. Microsoft's table feature comparison shows that data export rules, export jobs and workspace replication support the Analytics and Basic plans but not Auxiliary. Of the two that qualify, Basic has the lower ingestion cost, and rare queries suit its pay-per-query model. Auxiliary is the tempting answer on price but fails both requirements.

How to reason it out
  1. Find the features the table must support: export rule and replication.
  2. Rule out plans that lack either feature (Auxiliary).
  3. Among the rest, choose the lowest ingestion cost (Basic).

Exam tip: Need export or workspace replication? Auxiliary is out; Basic is the cheapest plan that keeps both.

AZ-305 Logging and Monitoring Design: Log Analytics Workspaces, Log Routing, Alerts and Azure Monitor — the lesson that teaches this.

Question 6Design identity, governance, and monitoring solutions

A bank must retain sign-in and audit logs for seven years. The logs are queried interactively for 90 days and rarely after that, but auditors must still be able to run KQL against old data from the same workspace. The bank doesn't want to manage separate storage accounts and wants to minimize cost. What should you recommend?

Choose one.

  • a
    Set seven years of analytics retention on the tables and keep the default plan

    Analytics retention extends to two years at most, and keeping old data in analytics retention costs more than long-term retention.

  • b
    Create a data export rule to a storage account and move blobs to the archive tier

    Export to storage means managing a separate store, and archived blobs can't be queried with KQL from the workspace.

  • c
    Set 90 days of analytics retention and seven years of total retention on the tables Correct

    The workspace keeps data beyond analytics retention at a low long-term price, up to 12 years, and it stays reachable with KQL through search jobs or restore.

  • d
    Enable workspace replication and keep 90 days of retention in each region

    Replication protects against a regional outage; it doesn't extend how long data is kept.

The concept

A Log Analytics table has analytics retention (up to two years) and total retention (up to 12 years) with low-cost long-term retention in between.

Why that’s the answer

Long-term retention keeps data in the workspace after the analytics period, at a lower price, for a total of up to 12 years. The data stays in the same tables' scope, reachable with search jobs or restore, so there's no separate storage to manage. Analytics retention can't reach seven years and would cost more. Export to archive storage leaves the workspace and can't be queried with KQL in place. Replication doesn't change retention.

How to reason it out
  1. Split the period into 'queried often' (analytics) and 'kept for compliance' (long-term).
  2. Check the limits: analytics up to two years, total up to 12 years.
  3. Prefer in-workspace long-term retention when KQL access and no extra storage are required.

Exam tip: Keep years of logs queryable in place: short analytics retention plus long total retention.

AZ-305 Logging and Monitoring Design: Log Analytics Workspaces, Log Routing, Alerts and Azure Monitor — the lesson that teaches this.

What AZ-305 domain 1 tests, topic by topic

The official exam guide breaks Design identity, governance, and monitoring solutions into 3 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published AZ-305 practice questions per topic in Design identity, governance, and monitoring solutions
TopicWhat it coversQuestions
Design solutions for logging and monitoringSkills outline section (AZ-305, skills measured as of April 17, 2026): Recommend a logging solution; Recommend a solution for routing logs; Recommend a monitoring solution.45
Design authentication and authorization solutionsSkills outline section (AZ-305, skills measured as of April 17, 2026): Recommend an authentication solution; Recommend an identity management solution; Recommend a solution for authorizing access to Azure resources; Recommend a solution for authorizing access to on-premises resources; Recommend a solution to manage secrets, certificates, and keys.45
Design governanceSkills outline section (AZ-305, skills measured as of April 17, 2026): Recommend a structure for management groups, subscriptions, and resource groups, and a strategy for resource tagging; Recommend a solution for managing compliance; Recommend a solution for identity governance.45
Total135

Revise Design identity, governance, and monitoring solutions before you drill it

AZ-305 Logging and Monitoring Design: Log Analytics Workspaces, Log Routing, Alerts and Azure MonitorQuestions on this topic are design scenarios: an organisation describes its estate and two or three requirements, such as data residency, a single copy of the data, a retention period, no code change, the least administrative effort or the lowest cost, and asks what you should recommend. The options are real Azure Monitor features that each miss one requirement: a table plan that is cheaper but doesn't support export, a destination in the wrong region, a policy effect that only audits, an alert type that watches the wrong signal, or a retired agent or test type. Some items ask you to select two components that together form the solution, or to explain why a planned design fails, such as a remediation task without rights on the destination or DCRs not linked to a replicated workspace's endpoint. Know what each feature does, what it can't do and its limits (destinations per setting, same-region rules, retention ceilings, new data only), and read every requirement before choosing.AZ-305 Authentication and Authorization Design: Hybrid Sign-in, Conditional Access, External Identities, RBAC, PIM and Key VaultQuestions on this topic are design scenarios: an organization, its current estate and two or three requirements such as 'no servers in the perimeter', 'no standing access', 'least administrative effort', 'lowest licence cost' or 'no credentials stored'. The options are usually real Microsoft Entra or Azure features that solve a neighbouring problem, for example password hash sync next to pass-through authentication, the passwordless strength next to the phishing-resistant one, B2B collaboration next to B2B direct connect, Key Vault Reader next to Secrets User, or Managed HSM next to Cloud HSM, and each wrong option misses exactly one requirement. Expect some 'select two' items where both halves of a design are needed, such as a service plus the prerequisite it depends on, or a configuration plus the setting that lets consumers follow it. Read every requirement, find the one that rules out the near-twin, and check licensing and lifecycle details (P1 vs P2, deleted with the resource, eligible vs active) before choosing.Azure Governance Design for AZ-305: Management Groups, Subscriptions, Tagging, Azure Policy and Identity GovernanceQuestions are design scenarios: an organisation describes its subscriptions, billing, teams or partners and two or three requirements — apply to future subscriptions, minimize administrative effort, never fail deployments, do not change resources, stay in compliance reporting, end automatically, block even subscription Owners, approval and expiry — and you recommend the structure, policy effect, scope or governance feature that meets all of them. The wrong options are usually real Azure features that would work in a similar scenario but miss one stated requirement, such as the scope, whether it changes resources, whether it ends on its own, or who it applies to. Expect multi-response items that ask for two settings or actions that together complete a solution.

Other AZ-305 domains

Domain 2: Design data storage solutions22% of the exam · 105 questionsDomain 3: Design business continuity solutions17% of the exam · 82 questionsDomain 4: Design infrastructure solutions33% of the exam · 160 questionsAll AZ-305 practice questionsMixed sessions across all 4 domains — the way the real exam interleaves them.

Design identity, governance, and monitoring solutions: your questions

Design identity, governance, and monitoring solutions is domain 1 of the AZ-305 exam guide and carries 28% of the scored content — the 2nd-heaviest of the 4 domains. On a 50-question paper that works out to roughly 14 questions, though Microsoft Azure does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official AZ-305 exam guide.