AZ-500 Practice Test 46 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to assess regulatory compliance. You need to ensure that the compliance dashboard reflects the latest standards and that custom assessments are included. What should you do?

Accepted Answer

Add a custom regulatory compliance standard in Defender for Cloud.. Option C is correct because the regulatory compliance dashboard in Defender for Cloud allows you to add custom initiatives and standards, including custom assessments. Option A is wrong because Azure Blueprints are deprecated and not the correct tool. Option B is wrong because Azure Policy alone does not integrate with the compliance dashboard. Option D is wrong because Microsoft Purview compliance portal is for data governance, not cloud security compliance assessment.

Answer

Configure Microsoft Purview compliance portal to include Azure subscriptions.

Answer

Use Azure Policy to apply custom definitions and assign to management groups.

Answer

Create an Azure Blueprint with custom policies.

Question 2

Your security team receives a high-priority alert from Microsoft Sentinel indicating a potential brute-force attack against an Azure SQL Database. The alert was generated by an analytics rule using the following KQL query: 'SigninLogs | where ResultType == "50057" | summarize Count = count() by UserPrincipalName, IPAddress | where Count > 10'. What is the most likely cause of the alert?

Accepted Answer

Multiple sign-in attempts using a disabled account from the same IP address.. Option B is correct because ResultType 50057 indicates 'User account is disabled', so the alert is triggered when a disabled account has more than 10 sign-in attempts from the same IP. Option A is wrong because MFA failure is a different result type. Option C is wrong because the query does not check if the user is enabled. Option D is wrong because the query specifically targets a disabled account, not a non-existent one.

Answer

Multiple failed MFA attempts by a user.

Answer

A user successfully signed in after many attempts.

Answer

Multiple sign-in attempts from a non-existent user account.

Question 3

Your organization uses Microsoft Sentinel to detect threats across Azure, AWS, and on-premises environments. You need to create an analytics rule that will generate an incident when more than 10 failed logon attempts occur within 5 minutes from the same source IP. Which rule type should you use?

Accepted Answer

Near-real-time (NRT) rule. Option C is correct because NRT rules run near real-time and are ideal for threshold-based detection over short windows. Option A is wrong because scheduled rules have a delay and are not near real-time. Option B is wrong because ML Behavior Analytics uses machine learning, not static thresholds. Option D is wrong because Fusion is for advanced multistage attacks.

Answer

Fusion rule

Answer

ML Behavior Analytics rule

Answer

Scheduled query rule

Question 4

Your company deploys a new Azure application gateway with WAF policy in prevention mode. After deployment, users report that legitimate traffic is being blocked. You need to identify which WAF rules are causing the blocks without affecting the security posture. What should you do?

Accepted Answer

Change the WAF policy mode to detection.. Option D is correct because switching to detection mode logs WAF events without blocking, allowing analysis. Option A is wrong because disabling WAF removes protection. Option B is wrong because changing to custom rules might not pinpoint the cause. Option C is wrong because custom rules are not diagnostic.

Answer

Disable the WAF policy temporarily.

Answer

Create a custom rule to allow all traffic.

Answer

Set the WAF policy to custom rules only.

Question 5

A company uses Microsoft Defender for Cloud's workload protection for Azure Storage. They want to receive alerts when there is suspicious access to blob storage. Which TWO features should they enable?

Accepted Answer

Microsoft Defender for Cloud for Storage. Option B and Option C are correct because Microsoft Defender for Cloud for Storage includes threat detection that alerts on suspicious access patterns, and enabling logging to the Log Analytics workspace provides detailed data for analysis. Option A is wrong because Azure Storage Firewall restricts access but does not generate alerts. Option D is wrong because Azure Storage Encryption protects data at rest, not access monitoring. Option E is wrong because Azure Defender is the old name; the correct name is Microsoft Defender for Cloud.

Answer

Azure Storage Firewall

Answer

Azure Defender for Storage

Answer

Azure Storage Encryption

Question 6

You are investigating a security incident in Microsoft Sentinel. A KQL query returns results indicating that a user logged in from an IP address that is not in the organization's approved list. The user's account has been compromised. You need to automatically disable the user account in Microsoft Entra ID when such an alert is triggered. What should you configure?

Accepted Answer

Create a playbook in Microsoft Sentinel with a Logic Apps connector to Microsoft Entra ID.. Option D is correct because Microsoft Sentinel can use automation rules with playbooks (based on Azure Logic Apps) to trigger actions like disabling a user in Microsoft Entra ID. Option A is wrong because Azure Policy cannot disable user accounts. Option B is wrong because Microsoft Defender for Cloud does not manage Entra ID user accounts. Option C is wrong because Power Automate is not natively integrated with Sentinel for this purpose.

Answer

Configure an Azure Policy that disables the user account.

Answer

Use Microsoft Defender for Cloud to automatically disable the account.

Answer

Create a Power Automate flow triggered by the Sentinel alert.

Question 7

You receive a Microsoft Defender for Cloud recommendation: 'Azure Policy Add-on for Kubernetes should be installed and enabled on your clusters'. The recommendation is marked as 'Unhealthy' for your AKS cluster. However, you have already installed the Azure Policy add-on. What is the most likely cause?

Accepted Answer

The AKS cluster does not have the 'azurepolicy' namespace.. Option B is correct because if the AKS cluster does not have the 'azurepolicy' namespace, the add-on is not properly installed or the cluster was created without it. Option A is wrong because the add-on is for Azure Policy, not Defender. Option C is wrong because a custom policy might override but would not cause this specific recommendation. Option D is wrong because the recommendation is about installation, not configuration.

Answer

A custom Azure Policy initiative overrides the built-in one.

Answer

The cluster's network policy is blocking the add-on's webhook.

Answer

The Microsoft Defender for Cloud agent is not installed on the cluster.

Question 8

A security analyst reports that a high-priority alert in Microsoft Sentinel for 'Malware detected on VM' was closed without investigation. You need to ensure that all alerts of severity High and above cannot be closed without adding a comment. What should you configure in Sentinel?

Accepted Answer

Modify the 'Analytics rule settings' to require a closing comment for high severity.. Sentinel allows setting a 'minimum severity level' for closing comments in the analytics rule settings or via automation rules. Option B is wrong because playbooks automate response, not enforce comments. Option C is wrong because watchlists are for enrichment. Option D is wrong because user and entity analytics is for UEBA.

Answer

Enable UEBA (User and Entity Behavior Analytics) to track closure patterns.

Answer

Create an automation rule that sets the incident severity and requires a comment when closing.

Answer

Configure a playbook that checks for comments before closing.

Question 9

Refer to the exhibit. You assign this built-in policy to a resource group containing Linux VMs. The policy is intended to deploy the Log Analytics agent if it is missing. After the assignment, you notice that the policy does not evaluate any VMs and the compliance state is 'Not started'. What is the most likely reason?

Accepted Answer

The policy mode 'Indexed' requires a remediation task to be created; the policy only evaluates resources when a remediation task is triggered.. Option C is correct because the policy mode is 'Indexed', which only evaluates resource types that support tags and location; virtual machines are indexed, but the policy might not trigger if the assignment scope is not a management group or subscription. Option A is wrong because the parameter is required. Option B is wrong because the agent is not installed, but the policy should evaluate. Option D is wrong because built-in policies can be assigned.

Answer

The policy parameter 'workspaceId' is not provided during assignment.

Answer

Built-in policies cannot be assigned directly to a resource group; they must be assigned to a management group.

Answer

The Log Analytics agent is already installed on all VMs.

Question 10

Your company has a Microsoft Sentinel workspace that ingests logs from Azure AD, Azure Activity, and Azure Firewall. You are investigating an incident where an attacker gained access to a user's credentials and logged in from an unusual location. The sign-in log shows that the user passed MFA. You suspect that the attacker might have used a phishing attack to bypass MFA. Which Microsoft 365 Defender feature should you enable to detect such attacks?

Accepted Answer

Microsoft 365 Defender's Attack simulation training.. Option D is correct because 'Attack simulation training' in Microsoft 365 Defender allows you to simulate phishing attacks and identify users who are vulnerable. Option A is wrong because 'Conditional Access policies' are for enforcing MFA, not detecting phishing. Option B is wrong because 'Identity Protection' detects risky sign-ins but does not simulate attacks. Option C is wrong because 'Microsoft Defender for Office 365' includes anti-phishing but not simulation.

Answer

Microsoft Defender for Office 365's anti-phishing policies.

Answer

Microsoft Entra Conditional Access policies with session control.

Answer

Microsoft Entra Identity Protection with user risk policy.

Question 11

You are deploying Microsoft Sentinel in a new Azure environment. Which THREE resources are required to deploy a Sentinel workspace?

Accepted Answer

Contributor permissions on the resource group. Option A, Option B, and Option D are correct because Sentinel requires a Log Analytics workspace, a Contributor role on the resource group to deploy resources, and the Microsoft.OperationsManagement resource provider to be registered. Option C is wrong because the Azure Sentinel resource provider is not required; the OperationsManagement provider is needed. Option E is wrong because Microsoft Defender for Cloud is not a prerequisite.

Answer

Microsoft Defender for Cloud enabled

Answer

The Microsoft.Sentinel resource provider registered

Question 12

Which TWO actions can you perform using Microsoft Defender for Cloud's 'Security Alerts' page?

Accepted Answer

View the kill chain of an alert.. Option A is correct because you can suppress alerts. Option C is correct because you can view the kill chain. Option B (remediation script) is not a direct feature; Option D (modify policy) is done via Azure Policy; Option E (create automation) is done in Sentinel.

Answer

Run a remediation script against the affected resource.

Answer

Create an automation rule to trigger a playbook.

Answer

Modify the security policy of the subscription.

Question 13

Your security operations center (SOC) uses Microsoft Sentinel. You need to ensure that an incident is automatically created when a specific type of alert fires from Microsoft Defender for Cloud. What is the most efficient way to configure this?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector in Sentinel and enable incident creation.. Option A is correct because the data connector for Microsoft Defender for Cloud ingests alerts and automatically creates incidents based on the analytics rule. Option B is wrong because a playbook runs after incident creation, not before. Option C is wrong because a workbook is for visualization. Option D is wrong because a scheduled rule queries logs but doesn't directly connect to Defender alerts.

Answer

Create a playbook that triggers on alert and generates an incident via API.

Answer

Design a workbook to monitor alerts and manually create incidents.

Answer

Write a scheduled analytics rule that queries Defender for Cloud logs.

Question 14

Refer to the exhibit. You are reviewing a policy assignment in Microsoft Defender for Cloud that deploys the Log Analytics agent to Azure VMs. The policy uses 'DeployIfNotExists' effect and specifies a workspace. However, newly created VMs are not showing the agent installed. What is the most likely cause?

Accepted Answer

The policy assignment does not have a managed identity assigned.. DeployIfNotExists policies require a managed identity to perform remediation. If the policy assignment does not have a managed identity, it cannot deploy the agent. Option A is wrong because 'Disabled' effect would not attempt deployment. Option B is wrong because the workspace location does not need to match. Option D is wrong because the agent can be deployed to multiple workspaces via policy.

Answer

The workspace ID is incorrect.

Answer

The policy effect is set to 'Disabled'.

Answer

The Log Analytics workspace is in a different region than the VMs.

Question 15

Your organization is using Microsoft Sentinel to centralize security data from multiple sources. You need to ensure that data from Azure Active Directory (now Microsoft Entra ID) logs is ingested. Which two of the following should you configure? (Choose two.)

Accepted Answer

Configure diagnostic settings in Microsoft Entra ID to stream audit and sign-in logs to a Log Analytics workspace.. Option A and Option D are correct because Microsoft Entra ID logs are ingested via diagnostic settings, and the data connector in Sentinel is used to establish the connection. Option B is wrong because a Log Analytics workspace is required, not a separate one. Option C is wrong because the Log Analytics agent is for VMs, not for Entra ID logs. Option E is wrong because there is a specific connector for Entra ID.

Answer

Enable the Microsoft 365 Defender data connector in Sentinel.

Answer

Create a separate Log Analytics workspace for Microsoft Entra ID logs.

Answer

Install the Log Analytics agent on domain controllers.