AZ-500 Practice Test 15 — 15 Questions

Question 1

You are configuring Microsoft Defender for Cloud's regulatory compliance dashboard. Your organization must comply with SOC 2. You have enabled the SOC 2 regulatory compliance standard. After a week, some controls show as 'Unhealthy'. What is the most likely reason for the 'Unhealthy' status?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The underlying Azure Policy initiatives have resources that are non-compliant.. The 'Unhealthy' status in Defender for Cloud's regulatory compliance dashboard indicates that the underlying Azure Policy initiatives associated with the SOC 2 standard have identified resources that are non-compliant. Defender for Cloud maps regulatory standards to Azure Policy definitions, and the compliance score is derived from the compliance state of those policies. Therefore, when controls show as 'Unhealthy', it is because the corresponding Azure Policy evaluations have found resources that do not meet the required configuration or security controls defined by SOC 2.

Answer

The standard is not fully enabled for all subscriptions.

Answer

The SOC 2 standard is not supported by Defender for Cloud.

Answer

You need to manually attest to the controls to mark them as healthy.

Question 2

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. The query returns a list of IP addresses that have attempted to sign in more than 10 times in the last day. You notice that the query does not filter out successful sign-ins. You need to modify the query to count only failed sign-in attempts. What should you add?

Accepted Answer

Add '| where ResultType != "0"' before the summarize. In Microsoft Sentinel, the KQL query for sign-in logs uses the 'ResultType' field to indicate success or failure. A 'ResultType' of '0' represents a successful sign-in, while any non-zero value indicates a failure. Therefore, to count only failed sign-in attempts, you must filter with '| where ResultType != "0"' before the summarize operator. Option D correctly applies this filter, excluding successful sign-ins and ensuring the count reflects only failures.

Answer

Add '| where Status == "Failure"' before the summarize

Answer

Add '| where Result == "Failure"' before the summarize

Answer

Add '| where ResultType == "0"' before the summarize

Question 3

A company stores sensitive data in Azure Blob Storage. They want to encrypt the data at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, they want the key to be automatically rotated every 90 days without manual intervention. Which configuration should they implement?

Accepted Answer

Enable Azure Storage encryption with a CMK and enable automatic key rotation in Azure Key Vault by creating a rotation policy.. Azure Key Vault supports automatic key rotation through a rotation policy, which can be configured to rotate a customer-managed key (CMK) every 90 days without manual intervention. When Azure Storage encryption uses a CMK stored in Key Vault, the storage account references the key version, and enabling a rotation policy in Key Vault automatically creates new key versions, which Azure Storage then uses for encryption. This satisfies the requirement for automated 90-day rotation without manual steps.

Answer

Enable Azure Storage encryption with a CMK and configure a rotation policy on the storage account.

Answer

Enable Azure Storage encryption with a CMK and manually rotate the key every 90 days.

Answer

Use Azure Storage service-side encryption with platform-managed keys and enforce rotation via Azure Policy.

Question 4

You are designing a Microsoft Sentinel deployment for a multinational company. The company requires that data from different geographic regions be stored separately to comply with data residency laws. What is the recommended approach?

Accepted Answer

Deploy a separate Microsoft Sentinel workspace in each required region.. Microsoft Sentinel is built on top of Log Analytics workspaces, and each workspace is a distinct data container with its own retention, encryption, and geographic location. To comply with data residency laws that require data from different regions to be stored separately, you must deploy a separate Sentinel workspace in each required region. This ensures that data ingested from a specific region remains within that region's boundaries and is not mixed with data from other regions.

Answer

Deploy a single Sentinel workspace and use Azure Purview to tag data for residency.

Answer

Deploy a single Sentinel workspace and configure diagnostic settings to send data to separate Log Analytics workspaces.

Answer

Deploy a single Sentinel workspace and use data collection rules to route data to different storage accounts.

Question 5

Your organization uses Microsoft Defender for Cloud to protect Azure resources. You need to ensure that storage accounts are only accessible via HTTPS. What should you configure?

Accepted Answer

Enable 'Secure transfer required' in the storage account's configuration. Enabling 'Secure transfer required' on a storage account enforces HTTPS for all requests to the storage account, rejecting any HTTP traffic. This setting ensures that data in transit is encrypted using TLS, which aligns with the requirement to only allow HTTPS access.

Answer

Configure a storage account firewall to block HTTP

Answer

Use a private endpoint for the storage account

Answer

Create an Azure Policy to audit storage accounts that do not require secure transfer

Question 6

Your organization wants to use Microsoft Sentinel to automatically respond to high-severity incidents. Which feature should you configure?

Accepted Answer

Create an automation rule that triggers a playbook on incident creation.. Microsoft Sentinel automation rules allow you to define automated responses to incidents, such as triggering a playbook (a collection of actions based on Azure Logic Apps) when an incident is created. This directly meets the requirement to automatically respond to high-severity incidents without manual intervention.

Answer

Create an analytics rule with a high severity.

Answer

Create a workbook to visualize incidents.

Answer

Enable entity behavior analytics.

Question 7

Your company is using Microsoft Sentinel to monitor security events. You need to ensure that all incidents generated in Sentinel are automatically sent to a third-party ticketing system via a webhook. Which Sentinel feature should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created. The playbook can then use an HTTP action to call a webhook endpoint on the third-party ticketing system, sending the incident data automatically. This is the native, built-in mechanism for outbound event-driven integration with external systems.

Answer

Use a watchlist to map incidents to ticketing system IDs.

Answer

Create a workbook that exports incidents to the ticketing system.

Answer

Configure a data connector to the ticketing system.

Question 8

A company stores sensitive customer data in an Azure Storage account. The security policy requires that all data be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need the ability to disable the key in case of a security breach and have the data become inaccessible immediately. Which feature should they enable on the storage account to achieve this?

Accepted Answer

Enable Azure Storage encryption with customer-managed keys (CMK). Enabling Azure Storage encryption with customer-managed keys (CMK) allows the customer to use their own key stored in Azure Key Vault for encrypting the storage account data at rest. The key can be disabled or revoked in Key Vault, which immediately renders the data inaccessible because Azure Storage uses the key to wrap the data encryption key; without access to the CMK, decryption cannot occur.

Answer

Use service-managed keys (SSE) with platform-managed keys

Answer

Enable Azure Disk Encryption on VMs that access the storage account

Answer

Configure Azure Information Protection for the storage account

Question 9

A security analyst receives a high-severity alert in Microsoft Sentinel indicating a potential brute-force attack against an Azure VM. The analyst wants to automatically block the attacker IP for 24 hours. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Sentinel that runs a playbook to add a deny NSG rule.. It leverages Microsoft Sentinel's automation rules to trigger a playbook that programmatically adds a deny Network Security Group (NSG) rule, blocking the attacker's IP for a specified duration. This is the most efficient approach as it automates the response without manual intervention, directly modifying the NSG attached to the VM's subnet to drop inbound traffic from the malicious IP.

Answer

Enable Just-in-Time VM access to restrict all RDP traffic.

Answer

Create an Azure Policy to deny all traffic from the attacker IP.

Answer

Manually add a deny rule to the NSG attached to the VM's subnet.

Question 10

Your organization uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions have the 'Auto-provisioning' extension enabled for Log Analytics agent on new VMs. What should you configure?

Accepted Answer

Enable 'Auto-provisioning' in Defender for Cloud's environment settings.. Defender for Cloud's environment settings include a dedicated 'Auto-provisioning' toggle for the Log Analytics agent. When enabled, Defender for Cloud automatically installs the agent on any new Azure VM that is provisioned in the selected subscriptions, ensuring continuous monitoring without manual intervention. This is the native mechanism within Defender for Cloud to enforce agent deployment at scale.

Answer

Configure Azure Automation State Configuration to push the agent.

Answer

Set up data connectors in Microsoft Sentinel.

Answer

Create an Azure Policy assignment to deploy the Log Analytics agent.

Question 11

Refer to the exhibit. You are reviewing the encryption configuration of an Azure Log Analytics workspace used by Microsoft Sentinel. The configuration shows infrastructure encryption enabled and customer-managed key (CMK) from Azure Key Vault. What additional step must be taken to ensure that the CMK is used for all data?

Accepted Answer

Grant the Log Analytics workspace access to the Key Vault key. When you configure a customer-managed key (CMK) for a Log Analytics workspace, you must explicitly grant the workspace (via its managed identity) the 'Get', 'Unwrap Key', and 'Wrap Key' permissions on the Key Vault key. Without this access, the workspace cannot use the CMK to encrypt data at rest. Option C correctly identifies this required step.

Answer

Enable double encryption on Sentinel

Answer

Enable purge protection on the Key Vault

Answer

Ensure the Key Vault is in a different region than the workspace

Question 12

Refer to the exhibit. You are assigning a built-in Azure Policy definition to a subscription using Azure CLI. The policy is 'Audit VMs that do not use managed disks'. After assignment, you check in Microsoft Defender for Cloud and see that the policy is not generating any recommendations. What is the most likely reason?

Accepted Answer

The policy is not part of a Defender for Cloud security initiative.. Microsoft Defender for Cloud only generates security recommendations from policies that are part of a built-in or custom security initiative (such as the 'Microsoft cloud security benchmark' initiative). A standalone policy assignment, even if it has the 'Audit' effect, will not appear as a recommendation in Defender for Cloud unless it is included in an initiative that Defender for Cloud monitors.

Answer

The policy effect is set to 'Audit', but it should be 'Deny' to generate recommendations.

Answer

The policy requires a managed identity to run.

Answer

The policy is assigned to the wrong subscription.

Question 13

A company uses a hub-spoke network topology in Azure. They need to inspect and filter all traffic flowing between spoke virtual networks for security compliance. Which Azure-native service should be deployed in the hub virtual network to achieve this?

Accepted Answer

Azure Firewall. Azure Firewall is a fully managed, stateful firewall-as-a-service that can inspect and filter traffic between spoke virtual networks when deployed in the hub VNet. It supports application (FQDN) and network (IP/port/protocol) rules, and can enforce security compliance by logging and blocking non-compliant traffic. Unlike a Network Virtual Appliance (NVA), Azure Firewall is a native PaaS service with built-in high availability and auto-scaling, making it the recommended choice for hub-spoke traffic inspection.

Answer

Network Virtual Appliance (NVA)

Answer

Azure VPN Gateway

Answer

Azure Load Balancer

Question 14

Your security team uses Microsoft Sentinel's UEBA (User and Entity Behavior Analytics) to detect insider threats. To enable UEBA, which data source must be connected to Sentinel?

Accepted Answer

Microsoft Entra ID data connector. Microsoft Sentinel's UEBA relies on Microsoft Entra ID (now Microsoft Entra ID) as the primary identity source to build behavioral baselines for users and entities. The Entra ID data connector ingests sign-in logs, audit logs, and risk detections, which are essential for UEBA to analyze patterns and detect anomalies indicative of insider threats. Without this identity telemetry, UEBA cannot establish the necessary behavioral profiles.

Answer

Azure Key Vault data connector

Answer

Office 365 data connector

Answer

Azure Activity log data connector

Question 15

A Sentinel scheduled rule runs every 5 minutes and looks back 1 hour. Analysts see repeated alerts for the same event. Which change best prevents duplicate detections without missing late-arriving logs?

Accepted Answer

Use an ingestion-time or event-time exclusion window in the query. Using an ingestion-time or event-time exclusion window in the query allows the rule to skip events that have already generated an alert within a specific time range, preventing duplicate detections while still accommodating late-arriving logs. This approach leverages the query logic to filter out duplicates based on a time-based deduplication key, ensuring that only new or unique events trigger alerts without altering the lookback period.

Answer

Reduce the query lookback to 1 minute

Answer

Disable alert grouping

Answer

Change the workspace retention period