AZ-500 Practice Test 38 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel to monitor security events. You need to configure automated response actions for incidents. Which TWO of the following can be used to trigger automated responses in Microsoft Sentinel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created or updated, based on conditions like severity or specific analytics rules. They can run playbooks (Azure Logic Apps) to execute complex workflows, such as sending notifications or creating tickets, without manual intervention.

Answer

Workbooks

Answer

Watchlists

Answer

Hunting queries

Question 2

A security team uses Microsoft Sentinel. They want to automatically isolate a compromised virtual machine by applying a network security group (NSG) rule. They have created a playbook in Azure Logic Apps that modifies the NSG. How should they trigger this playbook when an incident of type 'Suspicious VM activity' is created?

Accepted Answer

Create an automation rule in Microsoft Sentinel that is triggered when an incident is created, and set the action to run the playbook.. Microsoft Sentinel automation rules are designed to trigger playbooks automatically when incidents are created, updated, or closed. By configuring an automation rule with the condition 'When incident is created' and the action 'Run playbook', the playbook that modifies the NSG will execute immediately upon the creation of a 'Suspicious VM activity' incident, achieving the desired automated isolation without manual intervention.

Answer

Configure a data connector to send all alerts to the playbook.

Answer

Enable the playbook as a response action in the analytics rule.

Answer

Use a logic app trigger that polls Sentinel incidents every minute.

Question 3

You are deploying an Azure Storage account using an ARM template that includes a networkAcls section with defaultAction set to Deny. After deployment, you need to allow access from a specific public IP address. What should you do?

Accepted Answer

Add an IP rule to the ipRules array with the public IP address.. The ARM template includes a `networkAcls` section with `defaultAction` set to `Deny`, which blocks all traffic by default. To allow access from a specific public IP address, you must add an IP rule to the `ipRules` array, specifying the public IP address in CIDR notation (e.g., "20.10.10.10/32"). This overrides the default deny for that specific IP, enabling access while keeping the storage account locked down from other public traffic.

Answer

Create a private endpoint and assign it to the storage account.

Answer

Configure a service endpoint for the storage account.

Answer

Update the defaultAction to Allow and set ipRules to deny the IP.

Question 4

Your organization uses Microsoft Defender for Cloud to monitor Azure SQL databases. You receive an alert indicating a potential SQL injection attack. What is the most effective immediate action to validate and respond?

Accepted Answer

Review the SQL database auditing logs to identify the source queries. SQL database auditing logs capture detailed information about database events, including the exact SQL queries executed against the database. Reviewing these logs allows you to identify the source queries, the originating IP addresses, and the user accounts involved in the suspected SQL injection attack, enabling you to validate the alert and take targeted remediation actions. This is the most effective immediate step to confirm the attack and understand its scope before implementing broader security controls.

Answer

Enable Transparent Data Encryption (TDE) on the database

Answer

Run a vulnerability assessment on the database

Answer

Immediately block all IP addresses from the alert in the SQL firewall

Question 5

Which THREE are prerequisites for integrating Microsoft Sentinel with Microsoft Defender XDR? (Choose three.)

Accepted Answer

Appropriate permissions (Security Administrator or Global Administrator). Integrating Microsoft Sentinel with Microsoft Defender XDR requires the user to have either Security Administrator or Global Administrator roles in Microsoft Entra ID. These permissions are necessary to grant consent for the data connector and to configure cross-tenant or cross-service access policies that enable Defender XDR to send incident and alert data to Sentinel.

Answer

The Microsoft Monitoring Agent installed on all endpoints

Answer

An Azure Sentinel workspace in the same region as the Microsoft 365 tenant

Question 6

You need to configure a continuous export of Microsoft Defender for Cloud alerts to a third-party SIEM. Which feature should you use?

Accepted Answer

Use the continuous export feature in Defender for Cloud to stream alerts to an Event Hubs namespace.. The continuous export feature in Microsoft Defender for Cloud is specifically designed to stream security alerts and recommendations to an Event Hubs namespace, which can then be consumed by a third-party SIEM. This native integration eliminates the need for custom polling or scripting, ensuring near real-time data flow with minimal latency.

Answer

Create an Azure Logic App to periodically query and send alerts.

Answer

Use the Defender for Cloud REST API to pull alerts.

Answer

Configure Azure Monitor agent on all VMs.

Question 7

A financial services company uses Microsoft Sentinel to detect ransomware activity. They want to correlate alerts from multiple sources to reduce false positives. They have enabled Microsoft Defender for Cloud, Microsoft Defender XDR, and Azure Firewall logs. Which Sentinel feature should they use to create a single alert from multiple signals?

Accepted Answer

Fusion (machine learning) rules. Fusion (machine learning) rules in Microsoft Sentinel are specifically designed to correlate alerts from multiple sources—such as Microsoft Defender for Cloud, Microsoft Defender XDR, and Azure Firewall logs—by using machine learning models to identify multi-stage attack patterns and reduce false positives. This makes Fusion the correct choice for creating a single alert from multiple signals, as it automatically combines related alerts into a single, high-fidelity incident.

Answer

Near-real-time (NRT) rules

Answer

Anomaly detection rules

Answer

Scheduled query rules

Question 8

Which two security configurations should you apply to an Azure SQL Database to meet a requirement for data protection at rest and in transit?

Accepted Answer

Use Always Encrypted for sensitive columns.. Option B (Always Encrypted for sensitive columns) is correct because Always Encrypted protects sensitive data both at rest and in transit by keeping data encrypted on the client side, so the database engine never sees plaintext — the column encryption keys are never exposed to Azure SQL Database. Option C (Transparent Data Encryption, TDE) is correct because TDE performs real-time encryption and decryption of the database, backups, and transaction log files at rest using a symmetric database encryption key protected by a certificate stored in Azure Key Vault or the service-managed key store, satisfying the data-at-rest requirement. Option A (Microsoft Defender for Azure SQL) is not correct here because it is a threat detection and vulnerability assessment service, not a data encryption mechanism for protecting data at rest or in transit. Option D (firewall rules to allow only trusted IP addresses) is not correct because it is network access control, not encryption of data at rest or in transit. Option E (Azure SQL Auditing) is not correct because auditing tracks and logs database events for compliance and forensic purposes, but it does not encrypt or protect the data itself.

Answer

Enable Microsoft Defender for Azure SQL.

Answer

Configure firewall rules to allow only trusted IP addresses.

Answer

Enable Azure SQL Auditing.

Question 9

You have an Azure SQL Database that stores Personally Identifiable Information (PII). You need to mask the PII columns for support staff but allow full access to managers. What should you implement?

Accepted Answer

Dynamic Data Masking with a masking policy and grant UNMASK permission to managers. Dynamic Data Masking (DDM) obfuscates sensitive data in query results based on a masking policy, without altering the underlying data. Granting the UNMASK permission to managers allows them to see the original values, while support staff see masked data. This directly meets the requirement to mask PII columns for support staff but allow full access to managers.

Answer

Always Encrypted with separate column encryption keys for managers

Answer

Azure Information Protection labels and encryption

Answer

Row-level security to restrict rows for support staff

Question 10

A Defender for Cloud alert indicates possible credential theft on a VM. Which two response actions are sensible early containment steps?

Accepted Answer

Isolate the affected endpoint or restrict network access if business impact allows. Option A is correct because isolating the affected endpoint (for example, via Microsoft Defender for Endpoint's 'Isolate device' action) or otherwise restricting its network access stops an attacker from moving laterally or exfiltrating data while the investigation proceeds, and it is a standard early containment step when business impact permits. Option C is correct because credential theft means the attacker may hold valid account secrets, so resetting passwords and revoking tokens, sessions, or refresh tokens (for example, via Microsoft Entra ID revoke sessions or password reset) invalidates the stolen credentials and cuts off the attacker's access. Option B is not appropriate because deleting Log Analytics workspaces destroys the very telemetry and audit evidence needed to investigate the alert and would not contain the threat. Option D is not appropriate because disabling Defender for Endpoint onboarding removes the endpoint detection and response capability that is essential for monitoring, investigating, and remediating the compromised VM.

Answer

Delete all Log Analytics workspaces

Answer

Disable Microsoft Defender for Endpoint onboarding

Question 11

A security engineer needs to collect custom application logs from Azure VMs using Azure Monitor Agent for Sentinel analysis. Which two components are required?

Accepted Answer

A Data Collection Rule that defines the custom log collection. Option A is correct because a Data Collection Rule (DCR) is the Azure Monitor Agent mechanism that defines what data to collect, including custom logs via a custom text or JSON log definition, and where to send it (e.g., a Log Analytics workspace used by Microsoft Sentinel). Option C is correct because a DCR must be associated with the target machines (through a DCR association on the VM or via Azure Policy/monitoring insights) for the Azure Monitor Agent to actually apply that collection configuration to those VMs. Option B is incorrect because a storage account configured for static website hosting is unrelated to log ingestion by Azure Monitor Agent; custom logs are sent to a Log Analytics workspace, not served as web content. Option D is incorrect because Conditional Access policies govern user/identity sign-in access to resources and play no role in agent-based log collection from VMs.

Answer

A storage account configured for static website hosting

Answer

A Conditional Access policy requiring MFA

Question 12

A KQL hunting query joins SecurityIncident with SecurityAlert but returns duplicate rows for incidents with multiple alerts. What KQL approach best preserves one row per incident while summarizing alert details?

Accepted Answer

Use summarize make_set() or arg_max() grouped by IncidentNumber. `summarize make_set()` or `arg_max()` grouped by `IncidentNumber` collapses multiple alert rows into a single incident row while preserving alert details in an array or the most recent alert. This directly addresses the duplicate rows caused by a one-to-many join between SecurityIncident and SecurityAlert, ensuring one row per incident without data loss.

Answer

Use order by TimeGenerated desc only

Answer

Replace join with union

Answer

Use take 1 before the join

Question 13

A Defender for Cloud recommendation requires enabling private endpoints for a storage account. Which security risk is primarily reduced?

Accepted Answer

Public internet exposure of the storage service endpoint. Enabling private endpoints for a storage account connects it to an Azure Virtual Network over a private IP address, eliminating access from the public internet. This directly reduces the risk of public internet exposure of the storage service endpoint (Option B). The primary risk addressed is network-level exposure, not identity-related risks like unauthorized changes to Microsoft Entra ID users (Option C). While private endpoints can contribute to a defense-in-depth strategy, the most immediate and primary risk reduction is the removal of public network accessibility.

Answer

VM disk fragmentation

Answer

Unauthorized changes to Azure AD users

Answer

Excessive Log Analytics ingestion

Question 14

A company has a hub-spoke network topology in Azure. They need to inspect and filter all traffic flowing between spoke virtual networks for malicious content and require that the inspection is stateful. Which Azure-native service should they deploy in the hub virtual network to meet this requirement?

Accepted Answer

Azure Firewall. Azure Firewall is the correct choice because it is a fully stateful, managed firewall service that can inspect and filter traffic at Layers 3–7. In a hub-spoke topology, deploying Azure Firewall in the hub virtual network allows it to centrally inspect all traffic flowing between spoke virtual networks via forced tunneling (user-defined routes) or through the hub's network virtual appliance, meeting the requirement for stateful inspection of inter-spoke traffic.

Answer

Network Security Groups (NSG) on the peering connections

Answer

Azure Application Gateway with WAF

Answer

Azure DDoS Protection Standard

Question 15

A company uses Microsoft Defender for Cloud to protect its hybrid workloads. Security administrators report that critical alerts for SQL servers are not appearing in the Defender for Cloud dashboard. The SQL servers are on-premises and have Azure Arc enabled. Which configuration step should be verified first?

Accepted Answer

Enable the 'SQL servers on machines' plan in Microsoft Defender for Cloud. For on-premises SQL servers with Azure Arc, the 'SQL servers on machines' plan must be enabled in Microsoft Defender for Cloud to surface alerts. Without enabling this plan, alerts for SQL servers will not appear. Options A and C are related to agent deployment and policy assignment, but the first step is to ensure the plan is enabled. Option B is unrelated as Azure Firewall logs are not required for SQL-specific alerts.

Answer

Deploy the Log Analytics agent to the SQL servers

Answer

Configure Azure Firewall logs for SQL traffic

Answer

Assign the 'Configure Azure Defender for SQL agents on virtual machines' policy