AZ-500 Practice Exam 3 — 20 Questions

Question 1

Security analysts in your company use Microsoft Sentinel to manage incidents. They want to automatically assign any incident with a severity of 'High' or 'Critical' to the senior analyst on duty. Which Microsoft Sentinel feature should they configure to accomplish this?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific users or groups based on conditions such as severity. By creating an automation rule that triggers when an incident is created with a severity of 'High' or 'Critical', you can set the owner to the senior analyst on duty, fulfilling the requirement without manual intervention.

Answer

Playbooks

Answer

Workbooks

Answer

Analytics rules

Question 2

A KQL hunting query joins SecurityIncident with SecurityAlert but returns duplicate rows for incidents with multiple alerts. What KQL approach best preserves one row per incident while summarizing alert details?

Accepted Answer

Use summarize make_set() or arg_max() grouped by IncidentNumber. Option D is correct because `summarize make_set()` or `arg_max()` grouped by `IncidentNumber` collapses multiple alert rows into a single incident row while preserving alert details in an array or the most recent alert. This directly addresses the duplicate rows caused by a one-to-many join between SecurityIncident and SecurityAlert, ensuring one row per incident without data loss.

Answer

Use order by TimeGenerated desc only

Answer

Replace join with union

Answer

Use take 1 before the join

Question 3

A security team uses Microsoft Sentinel. They want to detect a potential privilege escalation scenario: when a user is added to the Global Administrator role in Azure AD (audit log) and within 10 minutes that user signs in from a suspicious location (sign-in log). Which type of analytics rule should they create to correlate these two different log sources?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that joins the AuditLogs table (for role assignment events) with the SigninLogs table (for sign-in events) and then uses a time window (e.g., 10 minutes) to correlate the two disparate log sources. This rule type supports cross-table joins and custom time-based correlation, which is exactly what is needed to detect a user added to Global Administrator followed by a suspicious sign-in.

Answer

Fusion rule

Answer

Anomaly rule

Answer

NRT rule (Near Real-Time)

Question 4

Traffic from a spoke VNet must reach the internet through a firewall in the hub VNet. What routing configuration is required on the spoke subnets?

Accepted Answer

A default route to the Azure Firewall private IP or virtual appliance next hop. To force spoke traffic to the internet through a firewall in the hub VNet, you must create a user-defined route (UDR) on the spoke subnet with an address prefix of 0.0.0.0/0 and a next hop of the Azure Firewall's private IP or the virtual appliance's IP. This overrides the default system route that would otherwise send internet-bound traffic directly out via Azure's edge, ensuring all egress traffic is inspected and controlled by the firewall.

Answer

A route to Internet with next hop Internet

Answer

An NSG deny rule for 0.0.0.0/0

Answer

A service endpoint policy

Question 5

A Sentinel analytics rule creates a new incident every time the same brute-force activity is detected for the same account within an hour. The SOC wants one incident that continues to group related alerts. What should be changed?

Accepted Answer

Configure incident grouping in the scheduled analytics rule. Option B is correct because incident grouping in a scheduled analytics rule allows multiple alerts triggered by the same entity (e.g., the same account) within a specified time window to be combined into a single incident. By configuring the 'Group related alerts into a single incident' setting and setting the grouping window to one hour, the SOC ensures that all brute-force alerts for the same account are merged into one incident, reducing alert fatigue and providing a consolidated view of the attack.

Answer

Disable entity mapping for the account entity

Answer

Change the rule query to use project-away on TimeGenerated

Answer

Run the rule as a near-real-time rule

Question 6

An organization wants to detect when a privileged Azure role assignment is created outside the approved change window. Which log source should a Sentinel rule query?

Accepted Answer

AzureActivity. AzureActivity logs capture all control-plane operations on Azure resources, including role assignment creations (e.g., 'Microsoft.Authorization/roleAssignments/write'). By querying AzureActivity in a Sentinel rule, you can detect when a privileged role assignment is made outside an approved change window. Heartbeat, Perf, and StorageBlobLogs do not record Azure RBAC changes.

Answer

Heartbeat

Answer

Perf

Answer

StorageBlobLogs

Question 7

A Sentinel data connector based on Azure Monitor Agent stops collecting Windows Security Events after migration from the legacy agent. What should the engineer verify first?

Accepted Answer

A Data Collection Rule is associated with the target machines and includes the required event streams. After migrating from the legacy Log Analytics Agent to the Azure Monitor Agent (AMA), data collection is governed by Data Collection Rules (DCRs). If the DCR is not associated with the target machines or does not include the required Windows Security Event data streams (e.g., `Microsoft-Event` or `SecurityEvent`), the Sentinel connector will stop receiving events. This is the most common root cause because AMA relies entirely on DCRs for configuration, unlike the legacy agent which used workspace settings directly.

Answer

The workspace has a saved KQL function named SecurityEvent

Answer

The machines are assigned an Azure Policy initiative for tags

Answer

The analytics rule is configured as near-real-time

Question 8

A security operations team uses Microsoft Sentinel. They have a scheduled analytics rule that generates an incident when a user signs in from an unusual location. They want to automatically assign the incident to the 'Security Engineering' team and set its severity to 'High' when it is created. Which feature should they use?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to centrally manage the automated handling of incidents, including assigning them to a specific team and setting their severity. When a scheduled analytics rule generates an incident, an automation rule can trigger on incident creation to perform these actions without requiring a playbook or manual intervention.

Answer

Playbooks

Answer

Incident settings in analytics rule

Answer

Workbooks

Question 9

A Sentinel analyst needs to preserve investigation notes, related entities, and ownership while escalating a case to another analyst. Which object should be updated?

Accepted Answer

The Sentinel incident. The Sentinel incident object is the correct entity to update because it serves as the central container for investigation notes, related entities, and ownership assignments during case escalation. Updating the incident preserves the full investigation context—including comments, tags, and assigned owner—ensuring seamless handoff between analysts without data loss.

Answer

A watchlist item

Answer

A workbook parameter

Answer

A data connector

Question 10

A Sentinel rule using a threat intelligence table fires on stale indicators that expired last week. What should be added to the query?

Accepted Answer

A filter for active indicators whose expiration time is in the future. The rule fires on stale indicators because the query lacks a filter to exclude expired threat intelligence entries. Adding a filter for active indicators whose expiration time is in the future ensures that only current, valid indicators trigger the rule, preventing false positives from outdated data.

Answer

A union with Usage

Answer

A sort by Description

Answer

A project-away of ConfidenceScore

Question 11

An AKS cluster must reduce risk from untrusted container images. Which two controls are most appropriate?

Accepted Answer

Scan container images for vulnerabilities before deployment. Option B is correct because scanning container images for vulnerabilities before deployment ensures that known security issues are identified and remediated before the images run in the cluster. This is a critical preventive control that directly reduces the risk of exploiting vulnerabilities in untrusted images. Azure Security Center and Azure Defender for container registries can automatically scan images in ACR and provide actionable findings.

Answer

Enable anonymous image pulls

Answer

Store Kubernetes secrets in plain text ConfigMaps

Question 12

A virtual network has a Frontend subnet (web servers) and a Backend subnet (Azure SQL Database). The security team requires that no internet traffic can reach the Backend subnet directly, but the Frontend subnet must be able to communicate with the Backend subnet on port 1433. Which solution should they implement?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are the correct solution because they provide stateful, layer-3/4 traffic filtering at the subnet or NIC level. By applying an NSG to the Backend subnet with a rule that denies all inbound internet traffic (deny all from Internet) and a higher-priority rule that allows inbound traffic from the Frontend subnet on TCP port 1433, you enforce the required isolation while permitting necessary SQL communication.

Answer

Azure Firewall with a routing table

Answer

Service Endpoints

Answer

Virtual Network Peering

Question 13

A security team uses Microsoft Sentinel. They have created a playbook in Azure Logic Apps that automatically isolates a compromised VM by modifying a network security group. They want the playbook to run automatically whenever an incident of type 'VM Isolation' is created. Which Microsoft Sentinel feature should they use to trigger the playbook automatically?

Accepted Answer

Automation rules.. Automation rules in Microsoft Sentinel are designed to trigger automated responses, such as running a playbook, when an incident is created or updated. In this scenario, the rule can be configured to match incidents of type 'VM Isolation' and automatically execute the Logic Apps playbook to isolate the compromised VM. This is the correct feature for incident-triggered automation without requiring a separate analytics rule.

Answer

Scheduled analytics rules.

Answer

Fusion rules.

Answer

Workbooks.

Question 14

An application hosted on an Azure VM needs to read secrets from Key Vault without storing credentials. Which identity pattern should be used?

Accepted Answer

System-assigned managed identity with Key Vault access granted by RBAC or access policy. A system-assigned managed identity enables an Azure VM to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically creates a service principal for the VM in Azure AD, and the VM can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) to authenticate to Key Vault. Access to secrets is then controlled by assigning RBAC roles (e.g., Key Vault Secrets User) or configuring a Key Vault access policy for that identity, eliminating the need for any stored secrets.

Answer

Client secret stored in appsettings.json

Answer

Shared access signature stored as an environment variable

Answer

A user account excluded from MFA

Question 15

A security team uses Microsoft Sentinel. They want to automatically assign a severity level and an owner to every incident that is created from a specific analytics rule. The owner should be a specific security operations group. Which Microsoft Sentinel feature should they configure to achieve this automation?

Accepted Answer

Create an automation rule that triggers when an incident is created and sets the severity and owner fields.. Automation rules in Microsoft Sentinel allow you to centrally manage incident handling by triggering actions when incidents are created or updated. By configuring an automation rule that triggers on incident creation from the specific analytics rule, you can automatically set the severity and assign the incident to a security operations group (via an Azure AD group or user) without custom scripting or manual intervention.

Answer

Modify the analytics rule to include a custom script that runs upon alert generation.

Answer

Use a Logic Apps playbook connected to the analytics rule's alert generation trigger.

Answer

Configure a workbook to filter and manually assign incidents.

Question 16

A security team uses Microsoft Sentinel. They create a scheduled analytics rule that queries Azure Activity Logs to detect virtual machines deployed in non-approved regions. The rule generates an incident. The team wants the incident to be automatically assigned to the 'Infrastructure' team and its severity set to 'High' when it is created. Which automation feature should they use?

Accepted Answer

Create an automation rule with trigger 'When incident is created' and actions to assign the incident to an owner and set severity. Option A is correct because automation rules in Microsoft Sentinel allow you to define triggers such as 'When incident is created' and then perform actions like assigning the incident to an owner and setting its severity. This is the native, no-code way to automate incident management without requiring a playbook or modifying the analytics rule itself.

Answer

Create a playbook triggered by alert creation that performs the assignment and severity change

Answer

Use an automation rule with trigger 'When incident is updated' and condition on alert type

Answer

Configure the analytics rule directly to set severity and owner

Question 17

Your company has an Azure subscription with a hub-spoke network topology. The hub contains an Azure Firewall and a VPN gateway for on-premises connectivity. The spoke virtual network hosts a critical application. You need to ensure that all outbound traffic from the spoke to the internet and on-premises networks flows through the Azure Firewall. You configure a user-defined route (UDR) on the spoke subnet with the default route (0.0.0.0/0) pointing to the Azure Firewall private IP. However, traffic to on-premises still bypasses the firewall. What is the most likely cause?

Accepted Answer

The on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the UDR. The most likely cause is that the on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the user-defined route (UDR). In Azure, when a UDR and a BGP-propagated route both match traffic, the route with the most specific prefix (longest prefix match) wins. Since on-premises networks are typically advertised with specific IP prefixes (e.g., 10.0.0.0/16) rather than 0.0.0.0/0, the BGP-learned routes take precedence, causing traffic to bypass the Azure Firewall.

Answer

The UDR must be applied to the subnet that hosts the Azure Firewall

Answer

The spoke subnet does not have 'GatewaySubnet' route propagation enabled

Answer

The Azure Firewall is not configured with a route to the on-premises network

Question 18

A team wants to automatically deploy Defender for Cloud settings across new subscriptions under a management group. Which Azure capability should they use?

Accepted Answer

Azure Policy initiative assignment. Azure Policy initiative assignments allow you to bundle multiple policy definitions (such as those for Defender for Cloud) and assign them at the management group scope. This ensures that all new subscriptions under that management group automatically inherit and enforce the Defender for Cloud settings, including enabling security monitoring and threat detection. This is the correct approach because Azure Policy provides continuous compliance evaluation and remediation at scale across the entire resource hierarchy.

Answer

Application security groups

Answer

Conditional Access templates

Answer

Sentinel workbooks

Question 19

A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. They have configured the role activation to require Azure Multi-Factor Authentication and a support ticket number. However, users are reporting that they can activate the role without entering a ticket number. What is the most likely cause?

Accepted Answer

The 'Require ticket information on activation' setting is not enabled in the role settings. Option A is correct because the 'Require ticket information on activation' setting is a separate toggle in the PIM role settings that must be explicitly enabled. Even if the support ticket number field is displayed in the activation form, the system will not enforce its entry unless this specific setting is turned on. Without it, users can leave the field blank and still successfully activate the role.

Answer

Users are activating through the Azure AD overview page instead of the PIM blade

Answer

The activation policy requires approval but the approvers ignore the ticket field

Answer

The role is configured for 'Active' assignment instead of 'Eligible'

Question 20

A security team uses Microsoft Sentinel. They want to create a playbook that automatically adds a tag 'isolated' to any Azure virtual machine that triggers a high-severity security alert. How should they configure the automation?

Accepted Answer

Create a playbook in Logic Apps and attach it to the alert as an automation rule. Option B is correct because Microsoft Sentinel playbooks are built on Azure Logic Apps and can be triggered by automation rules. An automation rule is configured to run when a high-severity alert is generated, and it invokes the playbook, which then uses the Azure Resource Manager connector to add the 'isolated' tag to the triggering virtual machine. This is the native, supported method for automated incident response in Sentinel.

Answer

Create an analytics rule with an automated response

Answer

Use a workbook to trigger the playbook

Answer

Configure a data connector