AZ-500 Practice Test 30 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing a scheduled analytics rule in Microsoft Sentinel that uses the KQL query shown. The rule is configured to run every hour. A security analyst reports that the rule is generating too many incidents. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The query does not filter out known safe IP addresses sufficiently.. The query likely uses a broad filter for sign-in events without excluding known safe IP addresses (e.g., corporate VPNs, trusted services). This causes every sign-in from those IPs to generate an incident, overwhelming the rule with false positives. The rule's frequency (every hour) is not the issue; the query logic is insufficiently scoped.

Answer

The rule is configured to run too frequently.

Answer

The query uses 'ago(1h)' which includes data from the previous hour, causing duplicate incidents.

Answer

The query has a syntax error that causes all sign-ins to match.

Question 2

Which TWO actions can you perform using Microsoft Defender for Cloud's regulatory compliance dashboard? (Select two.)

Accepted Answer

View the compliance status for built-in standards like SOC 2 or PCI DSS.. The regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of compliance status against built-in standards such as SOC 2, PCI DSS, ISO 27001, and Azure CIS. This dashboard aggregates security assessments and displays pass/fail status for each control, allowing you to track your compliance posture without manual configuration.

Answer

Create custom regulatory compliance recommendations.

Answer

Automatically remediate non-compliant resources.

Answer

Enable or disable Microsoft Defender plans for a subscription.

Question 3

You are the security engineer for a multinational company that uses Azure to host critical workloads. The company has deployed Microsoft Defender for Cloud with the enhanced security features enabled on all subscriptions. Recently, a security audit revealed that several virtual machines (VMs) in the production environment are missing critical security updates. The audit report indicates that the VMs are not being assessed for missing updates by Defender for Cloud. You need to ensure that all VMs are automatically assessed for missing OS updates using Defender for Cloud's vulnerability assessment capabilities. The solution must minimize administrative overhead and should not require manual installation of agents on existing VMs. What should you do?

Accepted Answer

Enable the 'Servers' plan in Defender for Cloud and ensure that the 'Vulnerability assessment for machines' setting is turned on.

Answer

Enable the 'SQL servers on machines' plan in Defender for Cloud.

Answer

Configure a vulnerability assessment solution from the Azure Marketplace and assign it to the VMs.

Answer

Deploy the Log Analytics agent to all VMs using Azure Policy.

Question 4

Your security team receives a high-priority alert from Microsoft Sentinel indicating a potential brute-force attack against an Azure SQL Database. The alert was generated by an analytics rule using the following KQL query: 'SigninLogs | where ResultType == "50057" | summarize Count = count() by UserPrincipalName, IPAddress | where Count > 10'. What is the most likely cause of the alert?

Accepted Answer

Multiple sign-in attempts using a disabled account from the same IP address.. The KQL query filters for ResultType == '50057', which specifically indicates 'User Account is Disabled'. The query then counts sign-in attempts by UserPrincipalName and IPAddress, triggering the alert when the count exceeds 10. This means the alert fires when there are more than 10 sign-in attempts from the same user and IP address against a disabled account, which matches the description of a brute-force attack targeting a disabled account.

Answer

Multiple failed MFA attempts by a user.

Answer

A user successfully signed in after many attempts.

Answer

Multiple sign-in attempts from a non-existent user account.

Question 5

Your company is migrating a legacy on-premises application to Azure VMs. The application writes log files to a local folder. You need to collect these logs centrally for security analysis using Microsoft Sentinel. The application runs on Windows Server 2022 and is expected to generate about 50 GB of logs per day. The security team requires that logs be encrypted at rest and in transit, and that log collection has minimal latency. You set up Azure Monitor Agent (AMA) on the VM and configure a Data Collection Rule (DCR) to stream custom logs to a Log Analytics workspace. However, after 24 hours, no custom logs appear in the workspace. The AMA is reporting as healthy. You need to troubleshoot and resolve the issue. What is the most likely cause?

Accepted Answer

The DCR does not include the correct table name for the custom log, or the table does not exist in the Log Analytics workspace.. The DCR must reference the custom log table created in the Log Analytics workspace; if the table name does not match or the table does not exist, logs will not be ingested. Option B: AMA can collect custom logs from a local file path; the path does not need to be a network share. Option C: The log file format is not limited to JSON; AMA can collect plain text logs with a defined pattern. Option D: The agent does not require local admin privileges for custom log collection; it runs as Local System.

Answer

The custom log file path specified in the DCR is a local path, but AMA requires a network share for custom log collection.

Answer

The log file format is not JSON, but AMA only supports custom logs in JSON format.

Answer

The VM does not have local administrator privileges required for the AMA to read the log files.

Question 6

A company has a hub-and-spoke network topology in Azure. The hub virtual network contains an Azure Firewall and a VPN gateway. Spoke virtual networks are peered to the hub. The security team wants to ensure that all outbound internet traffic from VMs in the spokes flows through the Azure Firewall. What should be configured?

Accepted Answer

Create a route table with a default route (0.0.0.0/0) to the Azure Firewall private IP and associate it with the spoke subnets.. To force all outbound internet traffic from spoke VNets through the Azure Firewall, you must create a route table with a default route (0.0.0.0/0) that has the Azure Firewall's private IP as the next hop, and associate that route table with the subnets in the spoke VNets. This overrides the default system route and sends all internet-bound traffic to the firewall. Option B is wrong because forced tunneling on a VPN gateway is used to route on-premises traffic, not to direct spoke traffic through the firewall. Option C is wrong because the route table should be associated with spoke subnets, not the hub subnet. Option D is wrong because NSGs do not support next-hop routing; they filter traffic, not direct it.

Answer

Configure forced tunneling on the VPN gateway to route all traffic through the Azure Firewall.

Answer

Create a route table with a default route to the VPN gateway and associate it with the hub subnet.

Answer

Configure an NSG on the spoke subnets with a rule that sends traffic to the Azure Firewall.

Question 7

Your company has multiple Azure subscriptions managed through Azure Firewall Manager. You need to deploy Azure Firewall policies that apply to all subscriptions in a region. What is the most efficient way to manage this?

Accepted Answer

Use Azure Firewall Manager to create a parent policy and assign it to all firewalls. Azure Firewall Manager provides a centralized management plane for firewall policies across multiple subscriptions and regions. By creating a parent policy and assigning it to all firewalls, you ensure consistent rule enforcement without duplicating effort. This approach is the most efficient because it leverages inheritance, where child policies can override specific rules while inheriting the parent's base configuration.

Answer

Create a separate firewall policy for each subscription

Answer

Use Azure Policy to enforce firewall rules across subscriptions

Answer

Deploy a single network security group (NSG) to all VNets

Question 8

Refer to the exhibit. You are configuring an Entitlement Management access package. The policy allows any existing user to request access without approval, and access expires after 30 days. However, security requirements dictate that all access to Finance applications must be reviewed by the finance team manager every quarter. What should you add to the policy?

Accepted Answer

Enable access reviews and assign the finance team manager as reviewer. The security requirement mandates quarterly reviews by the finance team manager, which is exactly what an access review does in Entitlement Management. Access reviews allow you to require periodic attestation of access by a designated reviewer, ensuring ongoing compliance even though the initial request does not require approval. The policy already sets a 30-day expiration, but a quarterly review adds a separate recurring governance check that overrides the shorter duration for compliance purposes.

Answer

Add a connected organization for external users

Answer

Set 'isApprovalRequiredForAdd' to true

Answer

Set 'durationInDays' to 90

Question 9

Which TWO of the following data connectors are available by default in Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (Option C) is a default data connector in Microsoft Sentinel because it provides native integration for streaming Microsoft Entra ID audit logs and sign-in logs directly into Sentinel without requiring additional licensing or configuration beyond enabling the connector. This is a core Microsoft source that is automatically available in the Sentinel data connector gallery.

Answer

Palo Alto Networks

Answer

ServiceNow

Answer

Amazon Web Services (AWS)

Question 10

You are configuring Microsoft Defender for Cloud's 'Workload protections' for a Kubernetes cluster that is already using Azure Kubernetes Service (AKS). The cluster has 'Azure Policy' enabled. You need to enable the 'Microsoft Defender for Containers' plan to protect the cluster. You have already enabled the plan at the subscription level. However, the cluster is not showing as protected in the 'Inventory' blade. You have confirmed that the 'Azure Policy for Kubernetes' add-on is installed. What should you do to ensure the cluster is protected?

Accepted Answer

Install the 'Defender profile' on the AKS cluster.. Even with the subscription-level plan enabled, you need to install the 'Defender profile' on the AKS cluster to enable protection. The Defender profile deploys the necessary agents for threat detection. Option A is correct. Option B is incorrect because Azure Policy for Kubernetes is already enabled; it is a separate feature. Option C is incorrect because protection does not automatically apply; you must install the profile. Option D is incorrect because the Log Analytics agent is not required for Defender for Containers; the Defender profile handles agent deployment.

Answer

Enable the 'Azure Policy for Kubernetes' add-on on the cluster.

Answer

Wait for 24 hours for the protection to automatically apply.

Answer

Install the Log Analytics agent on the cluster nodes.

Question 11

A team wants to deploy Sentinel content consistently across workspaces. Which two approaches are appropriate?

Accepted Answer

Use Content Hub solutions where available. Content Hub solutions in Azure Sentinel provide pre-packaged content (analytic rules, workbooks, playbooks) that can be installed consistently across multiple workspaces via the Azure portal or API. This ensures standardized deployment without manual errors, leveraging Microsoft's curated content for common scenarios.

Answer

Manually copy screenshots of rules

Answer

Store incidents in Azure Key Vault

Question 12

A company is deploying Microsoft Sentinel in a new Azure subscription. The security team wants to ingest Windows security events from on-premises servers. Which data connector should they use?

Accepted Answer

Windows Security Events via AMA (Azure Monitor Agent). The Windows Security Events via AMA connector is the current recommended method for streaming Windows security events to Azure Sentinel using the Azure Monitor Agent. Option B is wrong because the Microsoft Entra ID connector is for Microsoft Entra ID logs, not Windows events. Option C is wrong because the Office 365 connector is for Office logs. Option D is wrong because the Common Event Format (CEF) connector is for syslog from security appliances, not Windows security events.

Answer

Office 365 connector

Answer

Azure Active Directory connector

Answer

Common Event Format (CEF) connector

Question 13

Your organization uses Microsoft Entra ID and wants to implement a secure passwordless authentication strategy. Which TWO solutions can be used natively in Microsoft Entra ID for passwordless sign-in?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are a native passwordless authentication method in Microsoft Entra ID, leveraging the WebAuthn standard to provide phishing-resistant, hardware-based credential verification. They eliminate passwords entirely by using public-key cryptography, where the private key never leaves the device, ensuring strong security against credential theft.

Answer

Microsoft Authenticator app with OTP

Answer

Third-party password managers

Answer

Duo Security push notifications

Question 14

You are designing a security baseline for Microsoft Entra ID. Which THREE settings are recommended by Microsoft as part of the identity security baseline?

Accepted Answer

Enable risk-based Conditional Access policies. Risk-based Conditional Access policies are a core recommendation in the Microsoft identity security baseline. These policies automatically respond to detected user or sign-in risks (e.g., anonymous IP, leaked credentials) by requiring MFA or blocking access, aligning with the Zero Trust principle of continuous verification. Microsoft explicitly includes risk-based policies in its security baseline to proactively mitigate identity threats.

Answer

Allow self-service group management for all users

Answer

Set sign-in session timeout to 8 hours

Question 15

Your organization uses Microsoft Sentinel to detect threats across multiple Azure subscriptions. Security analysts need to query threat intelligence data from Microsoft Defender Threat Intelligence (MDTI) directly within Sentinel. However, analysts report that MDTI indicators are not appearing in ThreatIntelligenceIndicator table. What is the most likely cause?

Accepted Answer

The MDTI data connector is not enabled in Microsoft Sentinel.. The most likely cause is that the MDTI data connector is not enabled in Microsoft Sentinel. Without enabling this connector, threat intelligence indicators from Microsoft Defender Threat Intelligence will not be ingested into the ThreatIntelligenceIndicator table, regardless of other configurations. The connector must be explicitly installed and configured to pull MDTI data into the workspace.

Answer

The Sentinel workspace is located in a region where MDTI is not supported.

Answer

The subscriptions are not onboarded to Microsoft Defender for Cloud.

Answer

The Sentinel workspace is not using Azure Lighthouse for cross-subscription management.