Azure Solutions Architect Expert AZ-305 Practice Exam 2

Fabrikam Inc. is a global financial services company with 200 Azure subscriptions managed via a complex Management Group hierarchy. They currently operate in 5 Azure regions.

The security team requires that all security logs, performance metrics, and application telemetry from all resources across all subscriptions be collected for threat hunting and compliance reporting. The compliance team mandates that data must be retained for 2 years, and access to logs must be strictly segregated so that regional IT teams can only query logs for resources in their respective regions.

Which Log Analytics workspace architecture should you recommend to minimize operational overhead while meeting all security and compliance requirements?

A healthcare organization has 500 on-premises Windows Server VMs and 300 Azure VMs. They are implementing Azure Monitor to collect performance counters and event logs across the entire hybrid environment.

The CIO has mandated a strict cost optimization policy. You need to design a monitoring solution that meets the following requirements:

• Collect logs from both on-premises and Azure VMs.
• Minimize data ingestion costs for non-critical event logs.
• Ensure that on-premises VMs can be managed using Azure Policy.

Which THREE actions should you include in your recommendation? (Select THREE)

You are designing a security monitoring solution using Microsoft Sentinel.

The compliance department requires that all security incident data and associated logs be retained for exactly 7 years. The data must be available for interactive querying for the first 90 days, and afterward, it must be retained at the lowest possible cost while still being accessible for compliance audits within 48 hours if requested.

Which data retention strategy should you configure in the Log Analytics workspace?

Your company has a microservices application deployed across multiple Azure App Service instances. Each microservice sends telemetry to its own dedicated Application Insights instance.

The operations team needs to create an Azure Monitor Workbook that correlates performance data across all microservices to identify bottlenecks in the end-to-end transaction flow.

Which TWO approaches can you use to query data across multiple Application Insights instances? (Select TWO)

A defense contractor is migrating to Microsoft 365 and Azure. They have a strict security policy stating that no user password hashes, even in synchronized or encrypted form, can ever be stored in the cloud.

They require Single Sign-On (SSO) for their 10,000 employees. The on-premises Active Directory must be the sole authority for authentication. If the on-premises internet connection fails, users should NOT be able to authenticate to cloud services.

Which hybrid identity authentication method should you recommend?