AZ-500 Practice Test 14 — 15 Questions

Question 1

Your company uses Microsoft Defender for Cloud to protect Azure resources. You notice that some Azure VMs are not showing any security recommendations. You verify that the VMs are running and have network connectivity. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Log Analytics agent is not installed on the VMs. Microsoft Defender for Cloud relies on the Log Analytics agent (or Azure Monitor Agent) to collect security-relevant data from Azure VMs, such as configuration settings, event logs, and vulnerability signals. Without this agent installed, Defender for Cloud cannot assess the VM's security posture, and therefore no security recommendations will be generated for that VM, even if the VM is running and has network connectivity.

Answer

The VMs are in a resource group that lacks the required Azure RBAC role

Answer

The VMs have a resource lock preventing policy evaluation

Answer

The VMs are in the Free tier of Defender for Cloud

Question 2

You are configuring Microsoft Defender for Cloud's continuous export feature. You need to export security alerts and recommendations to a Log Analytics workspace for long-term retention and custom analysis. The export should include only high-severity alerts and recommendations. What should you do?

Accepted Answer

Enable continuous export in Defender for Cloud and select high-severity alerts and recommendations.. Microsoft Defender for Cloud's continuous export feature allows you to directly export security alerts and recommendations to a Log Analytics workspace with granular filtering by severity. This meets the requirement for long-term retention and custom analysis without additional services. Selecting 'high-severity' in the export configuration ensures only the specified alerts and recommendations are exported.

Answer

Set up Microsoft Sentinel to ingest Defender for Cloud alerts and then export to the workspace.

Answer

Configure diagnostic settings on each Azure resource to send logs to the workspace.

Answer

Use Azure Event Hubs to stream security alerts to the workspace.

Question 3

A company uses Microsoft Defender for Cloud to monitor its security posture. The compliance team wants to receive email notifications immediately when a control in the ISO 27001 regulatory compliance standard fails. They want to be alerted only when specific controls change from 'compliant' to 'non-compliant'. Which feature should they configure?

Accepted Answer

Workflow automation based on regulatory compliance assessment changes. Workflow automation in Microsoft Defender for Cloud can be configured to trigger based on regulatory compliance assessment changes, specifically when a control transitions from 'compliant' to 'non-compliant'. This allows the compliance team to receive immediate email notifications for ISO 27001 control failures without manual polling or dashboard monitoring.

Answer

Security Alerts from Microsoft Defender for Cloud

Answer

Regulatory Compliance dashboard with continuous export

Answer

Custom recommendations in Microsoft Defender for Cloud

Question 4

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Global Administrator' role. The security team wants to ensure that when a user activates the role, they must provide a justification, and the activation request must be approved by a specific group of security administrators. They have already configured the role for activation with a maximum duration of 8 hours. Which additional PIM settings should they configure?

Accepted Answer

Enable 'Require approval to activate' and select the security group as approver. The scenario requires both justification and approval for role activation. PIM allows you to enforce 'Require justification on activation' and 'Require approval to activate' as separate settings. By enabling 'Require approval to activate' and selecting the security group as the approver, you meet the requirement for approval. Justification is already a default requirement in PIM when approval is enabled, but you must also explicitly set 'Require justification on activation' to 'On' if not already enforced; however, the question states they have already configured the role for activation with a maximum duration, so the missing piece is the approval configuration.

Answer

Set 'Require Azure Multi-Factor Authentication' to 'On'

Answer

Set 'Require justification on activation' to 'On' and also enable 'Require ticket information'

Answer

Create a separate PIM request workflow using Azure Logic Apps

Question 5

A company has Azure virtual machines that need to download updates from specific external websites (e.g., *.microsoft.com and *.windowsupdate.com). The security team wants to centrally manage and allow outbound HTTPS traffic only to these FQDNs, while blocking all other outbound internet access. Which Azure networking service should they deploy to achieve this?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-native network security service that can centrally enforce outbound FQDN-based rules. It allows you to create application rules that permit HTTPS traffic to specific FQDNs (e.g., *.microsoft.com) while blocking all other outbound internet access, meeting the security team's requirement for granular, centralized control.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 6

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). You need to collect sign-in logs and audit logs. Which data connector should you enable?

Accepted Answer

Azure Active Directory (now Microsoft Entra ID). The Microsoft Entra ID (now Microsoft Entra ID) data connector is the correct choice because it is specifically designed to ingest both sign-in logs and audit logs from Microsoft Entra ID into Microsoft Sentinel. This connector enables the collection of user sign-in activities and directory audit events, which are essential for security monitoring and incident detection.

Answer

Azure AD Identity Protection

Answer

Office 365

Answer

Azure AD Authentication

Question 7

Refer to the exhibit. A Microsoft Sentinel analytics rule uses this KQL query. What is the primary purpose of this rule?

Accepted Answer

Detect users with multiple risky sign-ins from non-US countries.. The KQL query filters sign-ins with risk level 'medium' or 'high' from countries other than the US, then counts them per user and filters for users with more than one such sign-in. This directly detects users who have multiple risky sign-ins from non-US countries, making option B correct. The rule does not consider historical sign-in patterns or averages, only the count of risky sign-ins outside the US.

Answer

Detect users who have never signed in from the US before.

Answer

Detect impossible travel patterns between the US and other countries.

Answer

Detect users whose sign-in count is higher than the average for their region.

Question 8

You are configuring Microsoft Sentinel data connectors. Which data connector should you use to ingest logs from Microsoft Entra ID (Azure AD) audit logs and sign-in logs?

Accepted Answer

Microsoft Entra ID connector. The Microsoft Entra ID connector (formerly Azure AD connector) is specifically designed to ingest both audit logs and sign-in logs from Microsoft Entra ID into Microsoft Sentinel. This connector uses the Microsoft Graph API to pull the data, enabling security monitoring of identity-related activities such as user sign-ins, directory changes, and risky sign-in events. The other connectors either focus on different data sources or do not capture the full set of Entra ID logs.

Answer

Office 365 connector

Answer

Microsoft Defender XDR connector

Answer

Azure Activity connector

Question 9

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is in the same region and has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. However, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required to allow the SQL server to access the Key Vault for TDE operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault.. When Azure Key Vault has a firewall that denies all public network access, the 'Allow trusted Microsoft services to bypass this firewall' setting is required for Azure SQL Database (a trusted Microsoft service) to authenticate using its system-assigned managed identity and access the customer-managed key for TDE. This setting allows the SQL server to reach the Key Vault over the Microsoft backbone network without requiring a private endpoint or VNet integration, as the service is explicitly trusted by Azure.

Answer

Configure a private endpoint for the SQL server to the Key Vault.

Answer

Change the Key Vault firewall to allow all Azure services.

Answer

Create a VNet service endpoint for Microsoft.KeyVault on the SQL server's subnet.

Question 10

Your company uses Microsoft Defender for Cloud to protect Azure resources. You notice that some Azure VMs are not showing any security recommendations. You verify that the VMs are running and have network connectivity. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the regulatory compliance dashboard. The regulatory compliance dashboard in Microsoft Defender for Cloud provides a view of how your resources comply with specific security standards and baselines, such as the Microsoft Cloud Security Benchmark (MCSB) or custom regulatory frameworks. By selecting the appropriate compliance standard that matches your organization's security baseline, you can identify resources that are non-compliant with specific controls. This dashboard directly maps security assessments to compliance controls, making it the correct tool for identifying resources not meeting your baseline.

Answer

View the secure score

Answer

Review the security recommendations

Answer

Use the inventory blade

Question 11

A company has an Azure virtual network with a subnet that hosts a web application. The security team wants to allow inbound HTTPS traffic (port 443) from the internet to the web servers, but block all other inbound traffic. They have a network security group (NSG) associated with the subnet. What is the minimal set of inbound rules required?

Accepted Answer

A rule allowing HTTPS from Internet, and no other rules (default deny all inbound).. Network security groups (NSGs) in Azure have a default deny-all inbound rule (rule 65500) that is automatically applied to all inbound traffic. Therefore, you only need to add an explicit allow rule for HTTPS (port 443) from the Internet. No additional deny rule is required because the default rule already blocks all other inbound traffic.

Answer

A rule allowing HTTPS from Internet, and a default deny all rule.

Answer

A rule allowing HTTPS from Internet, and a rule explicitly denying all other inbound traffic.

Answer

A rule allowing HTTPS from any source, and a rule denying all other traffic with lower priority.

Question 12

You are configuring Microsoft Defender for Cloud to protect your Azure virtual machines. You need to enable just-in-time (JIT) VM access to reduce the attack surface. What prerequisite must be met?

Accepted Answer

Enable Microsoft Defender for Servers Plan 2.. Just-in-time (JIT) VM access in Microsoft Defender for Cloud requires Microsoft Defender for Servers Plan 2 to be enabled. This plan provides the advanced security capabilities, including JIT, vulnerability assessment, and file integrity monitoring. Without Plan 2, the JIT blade and policy options are not available, as Plan 1 only covers basic log collection and threat detection.

Answer

Configure Microsoft Defender for Cloud Apps with the VMs as connected.

Answer

Enable the Defender for Cloud 'JIT' plan.

Answer

Deploy Azure Bastion in the same virtual network.

Question 13

You are investigating a security incident in Microsoft Sentinel. The incident involves multiple alerts from different data sources. You need to correlate the alerts to determine the full attack chain. Which Microsoft Sentinel feature should you use?

Accepted Answer

Incident investigation. Incident investigation in Microsoft Sentinel is designed specifically for visualizing and correlating alerts within an incident to reconstruct the full attack chain. It provides a graphical map that links entities (e.g., IP addresses, user accounts, hosts) across alerts from different data sources, enabling you to trace the attacker's path step by step.

Answer

Analytics rules

Answer

Playbooks

Answer

Workbooks

Question 14

Refer to the exhibit. You are creating a Microsoft Sentinel scheduled analytics rule using the KQL query shown. The rule is set to run every hour. What will this rule detect?

Accepted Answer

Accounts that have more than 10 failed logins from a specific IP address in the last hour. The KQL query uses `summarize` with `bin(TimeGenerated, 1h)` to count failed logins per account and IP address within 1-hour bins. The `where` clause filters for `ResultType == 50057` (failed logins) and `where count_ > 10` ensures only accounts with more than 10 failed logins from a specific IP in that hour are returned. Since the rule runs every hour, it detects accounts exceeding 10 failed logins from a single IP in the last hour.

Answer

Successful logins from a single IP address

Answer

Total failed logins in the last 24 hours

Answer

Accounts with more than 10 failed logins from any IP address

Question 15

Your company uses Microsoft Defender for Cloud to protect Azure resources. You notice that some Azure VMs are not showing any security recommendations. You verify that the VMs are running and have network connectivity. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VM has not been rescanned after the remediation was applied.. The alert remains active because Microsoft Defender for Cloud relies on periodic vulnerability scans to update the security findings. Remediating the vulnerability on the VM does not automatically trigger a rescan; the alert status is only updated after the next scheduled scan or a manual rescan is initiated. Until the VM is rescanned, Defender for Cloud continues to display the previous vulnerable state.

Answer

The alert is a false positive due to a known issue in the vulnerability assessment engine.

Answer

The alert has a 30-day retention period and cannot be dismissed before that.

Answer

Silent Remediation was enabled, preventing the alert from being dismissed.