Designing Microsoft Azure Infrastructure Solutions (AZ-305) - 340 Questions

1. An enterprise architect must design an identity solution for a multinational corporation that has 50,000 employees spread across 12 subsidiaries. Each subsidiary currently runs its own on-premises Active Directory domain. The requirement is to provide seamless single sign-on (SSO) to Azure-hosted SaaS applications while maintaining each subsidiary's existing local authentication infrastructure. Password hash synchronization must NOT be used due to regulatory constraints. Which solution best satisfies these requirements?

2. A financial services company is deploying a new Azure environment and must enforce strict governance from day one. The architect must ensure that: (1) all new resource groups must have specific mandatory tags applied at creation time, (2) certain resource types such as public IP addresses must be denied in production subscriptions, and (3) these controls must be applied consistently across 30 subscriptions that belong to different business units. Which TWO Azure services should the architect combine to meet all three requirements most effectively?

3. An enterprise architect is designing an access control model for an Azure environment where developers need to deploy resources in their own sandbox subscriptions but must not be able to modify networking or identity configurations. Security administrators must be able to manage RBAC assignments only within the security scope without gaining access to application workloads. A least-privilege model is mandatory. Which approach best achieves this separation of duties?

4. A company requires that all privileged Azure AD role assignments for Global Administrator and Privileged Role Administrator be time-limited, require multi-factor authentication at activation, and generate an alert to the security team whenever an activation occurs. The solution must also enforce that eligible assignments expire after 90 days unless recertified. Which Azure service and configuration satisfies all of these requirements?

5. An enterprise architect must design a monitoring solution for a large Azure environment spanning 15 subscriptions. The requirements are: centralized log collection from all subscriptions, the ability to run cross-subscription Kusto queries, automated alerting when specific security events occur, and a 2-year log retention for compliance. The solution must minimize operational overhead. Which architecture best satisfies these requirements?