AZ-500 Practice Test 47 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud with the CSPM plan enabled. You need to ensure that all Azure subscriptions have Microsoft Defender for Cloud's auto-provisioning enabled for the Log Analytics agent. Which Azure Policy initiative should you assign?

Accepted Answer

Deploy Log Analytics agent for Microsoft Defender for Cloud. The Azure Policy initiative 'Deploy Log Analytics agent for Microsoft Defender for Cloud' includes policies to auto-provision the Log Analytics agent on VMs. Option B is correct. Option A is a built-in initiative for general security configuration, not specifically for auto-provisioning. Option C is for regulatory compliance. Option D is for Azure Backup.

Answer

Configure backup on virtual machines

Answer

CIS Microsoft Azure Foundations Benchmark

Answer

Azure Security Benchmark

Question 2

Your organization uses Microsoft Sentinel to monitor security events. You need to configure automated response actions for incidents. Which TWO of the following can be used to trigger automated responses in Microsoft Sentinel?

Accepted Answer

Automation rules. Option A (Playbooks) are automated workflows that can be triggered from analytics rules. Option B (Automation rules) centrally manage automated responses. Option C (Workbooks) are visualizations, not automated responses. Option D (Watchlists) are data sources. Option E (Hunting queries) are proactive searches, not automated responses.

Answer

Workbooks

Answer

Watchlists

Answer

Hunting queries

Question 3

Refer to the exhibit. You are assigning this Azure Policy to a management group. The goal is to automatically deploy the Azure Monitor Agent to Windows VMs that do not have it. However, after assignment, you notice that the policy is not deploying the agent. What is the most likely reason?

Accepted Answer

The policy definition is incomplete; it lacks the deployment specification for the DeployIfNotExists effect.. Option D is correct because the policy rule only checks if the resource type is a virtual machine, but it does not check whether the agent is already installed or not; it will attempt to deploy on every VM, but the deployment action is missing from the policy definition. The policy snippet only shows the condition and effect, but the actual deployment task (the 'deployment' property) is not included. Option A is wrong because the policy is built-in and includes all details. Option B is wrong because the policy mode 'Indexed' is correct for VMs. Option C is wrong because the effect 'DeployIfNotExists' is allowed.

Answer

The effect parameter is set to 'AuditIfNotExists'.

Answer

The policy mode should be 'All' instead of 'Indexed'.

Answer

The policy is a built-in policy and cannot be assigned.

Question 4

Your organization is using Microsoft Defender for Cloud to protect Azure SQL databases. You need to enable Advanced Threat Protection (ATP) for all existing and future Azure SQL databases in a subscription. The solution must minimize administrative effort. What should you do?

Accepted Answer

Enable the Azure SQL databases plan in Microsoft Defender for Cloud at the subscription level.. Option B is correct because enabling Defender for Cloud at the subscription level with the SQL servers on machines plan (or Azure SQL databases plan) will automatically enable ATP for all supported resources, including future ones. Option A is wrong because enabling per database is not scalable. Option C is wrong because Azure Policy can be used but is not the most efficient direct method. Option D is wrong because Microsoft Sentinel is not for enabling ATP.

Answer

Configure Microsoft Sentinel to monitor Azure SQL databases.

Answer

Create an Azure Policy to deploy Advanced Threat Protection on Azure SQL databases.

Answer

Enable Advanced Threat Protection on each Azure SQL database individually.

Question 5

You need to enable Microsoft Defender for Cloud's enhanced security features for an Azure subscription. Which of the following is required?

Accepted Answer

Enable 'Microsoft Defender for Cloud' at the subscription level.. Option B is correct because Enhanced security features (formerly Azure Defender) are enabled at the subscription level. Option A is wrong because Log Analytics is optional. Option C is wrong because you can enable individual plans. Option D is wrong because Azure Policy is not a prerequisite.

Answer

Enable all Defender plans at once.

Answer

Deploy a Log Analytics workspace in the same region.

Answer

Assign an Azure Policy to enforce Defender for Cloud.

Question 6

Your company has multiple Azure subscriptions and wants to use Microsoft Sentinel as a SIEM. You need to collect security events from all Azure VMs, including existing and future ones. What should you use?

Accepted Answer

Create an Azure Policy assignment to deploy the Log Analytics agent.. Azure Policy with DeployIfNotExists effect can automatically deploy the Log Analytics agent to all VMs in a subscription. Option A is wrong because manual installation is not scalable. Option C is wrong because Azure Automation DSC is for configuration management, not agent deployment. Option D is wrong because the Azure portal VM blade is manual.

Answer

Use the Azure portal to enable 'Security Center' on each VM.

Answer

Use Azure Automation Desired State Configuration (DSC) to push the agent.

Answer

Manually install the Log Analytics agent on each VM.

Question 7

Your organization uses Microsoft Defender for Cloud to secure a multi-cloud environment that includes Azure, AWS, and GCP resources. You need to ensure that all resources are assessed against a consistent set of security standards. What should you configure first?

Accepted Answer

In Defender for Cloud, add a regulatory compliance standard such as 'Azure CIS 1.4.0' and enable continuous export for all connected clouds.. Option B is correct because regulatory compliance standards such as Azure CIS 1.4.0 can be applied across multicloud resources in Defender for Cloud. Option A is wrong because AWS Security Hub is a separate service, not integrated natively. Option C is wrong because Azure Policy is for Azure-only. Option D is wrong because Microsoft Sentinel is for SIEM, not compliance standards.

Answer

Connect the AWS and GCP accounts to AWS Security Hub and Google Security Command Center respectively, then enable Defender for Cloud's multicloud connector.

Answer

Create Azure Policy initiatives and assign them to the management groups that contain the multicloud resources.

Answer

Configure Microsoft Sentinel to ingest security findings from AWS and GCP, then create custom alerts for compliance deviations.

Question 8

Your company is implementing Microsoft Defender for Cloud's Security Alerts. You need to ensure that alerts for critical severity are automatically sent to the security operations team via email and also create a ticket in ServiceNow. Which three actions should you take? (Choose three.)

Accepted Answer

Create a continuous export rule in Defender for Cloud to send alerts to an Event Hubs namespace.. Options A, C, and E are correct. Option A is correct because email notifications for critical alerts can be configured in Defender for Cloud. Option C is correct because a continuous export rule can send alerts to Event Hubs, which can trigger a Logic App. Option E is correct because a Logic App can integrate with ServiceNow. Option B is wrong because the Log Analytics agent is not needed for alerts. Option D is wrong because a playbook in Sentinel is not required; the integration can be done via Logic Apps directly.

Answer

Create a playbook in Microsoft Sentinel that triggers on alerts.

Answer

Install the Log Analytics agent on all VMs to collect security alerts.

Question 9

You have configured Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). You notice that sign-in logs for external guest users are not appearing in Sentinel. What is the most likely cause?

Accepted Answer

The diagnostic settings in Microsoft Entra ID are not configured to stream sign-in logs to the Log Analytics workspace used by Sentinel.. Sentinel ingestion of Entra ID logs requires diagnostic settings to be configured on the Entra ID tenant. By default, diagnostic settings are not enabled for external guest user sign-ins. Option C is correct. Option A is not a requirement. Option B is incorrect because guest user sign-ins are logged but need diagnostic settings. Option D is incorrect because the connector does not filter by user type.

Answer

Microsoft Sentinel does not support ingestion of external guest user sign-in logs.

Answer

The Microsoft Sentinel Entra ID connector requires a separate connector for guest users.

Answer

Guest user sign-ins are not logged in Microsoft Entra ID.

Question 10

You are configuring Microsoft Defender for Cloud to protect an Azure Kubernetes Service (AKS) cluster. The cluster runs sensitive workloads. You need to enable threat detection and vulnerability assessment for the AKS environment. Which THREE of the following should you enable?

Accepted Answer

Microsoft Defender for Containers plan. Option A (Defender for Containers) is the correct plan for AKS threat detection. Option B (Defender for Servers) is for VMs, not containers. Option C (Microsoft Defender for Cloud's vulnerability assessment for container images) is part of Defender for Containers. Option D (Azure Policy add-on for AKS) enables policy enforcement but is not threat detection. Option E (Microsoft Defender for Cloud's continuous export) is for exporting alerts, not detection.

Answer

Microsoft Defender for Servers plan

Answer

Azure Policy add-on for AKS

Question 11

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

To list the top 10 most frequent alert names along with their severity over the last 7 days.. Option A is correct because the query summarizes the count of alerts by AlertName and AlertSeverity and returns the top 10 by count descending. Option B is wrong because the query does not filter by severity. Option C is wrong because it returns top 10, not all. Option D is wrong because it does not filter by time beyond the initial 7 days.

Answer

To list all alerts with severity 'High' in the last 7 days.

Answer

To list all alerts generated in the last 7 days.

Answer

To list the count of alerts per severity for the last 7 days.

Question 12

Your organization uses Microsoft Sentinel to monitor hybrid environments. You have a Log Analytics workspace that collects Windows security events. You need to create an analytics rule that triggers when a user account is created on any server, but you only want to generate an incident if the account creation occurs outside of business hours (9 AM - 5 PM). How should you configure the rule query?

Accepted Answer

Use SecurityEvent where AccountCreated and TimeGenerated !between (9:00 and 17:00).. Option C is correct because the query filters events where the hour is not between 9 and 17 (24-hour format). Option A is wrong because it would trigger for any time. Option B is wrong because it filters for business hours only. Option D is wrong because it uses a different event ID.

Answer

Use SecurityEvent where EventID = 4720 and TimeGenerated !between (9:00 and 17:00).

Answer

Use SecurityEvent where AccountCreated and TimeGenerated between 9:00 and 17:00.

Answer

Use SecurityEvent where AccountCreated and then schedule the rule to run only during non-business hours.

Question 13

You are configuring Microsoft Sentinel to detect a new type of ransomware that encrypts files and changes file extensions. You need to create a detection rule that generates an incident when the same pattern of file changes occurs on multiple hosts within a short time. Which rule type should you use?

Accepted Answer

NRT (Near-Real-Time) query rule.. NRT rules run queries every minute with near real-time latency and can correlate events across multiple hosts. Option A is wrong because scheduled rules run on a schedule and may miss correlation. Option C is wrong because ML behavior analytics is for UEBA. Option D is wrong because Fusion is for multi-stage attacks.

Answer

Microsoft Security incident creation rule (ML behavior analytics).

Answer

Scheduled query rule.

Answer

Fusion rule (advanced multistage attack detection).

Question 14

Refer to the exhibit. You are reviewing a custom Azure Policy definition that will be assigned to a subscription to audit storage accounts and Cosmos DB accounts. The policy is intended to check whether these resources use customer-managed keys (CMK) for encryption. However, when you test the policy assignment, it does not evaluate Cosmos DB accounts. What is the most likely reason?

Accepted Answer

The existence condition in 'auditIfNotExists' only checks for storage account encryption; it does not evaluate Cosmos DB encryption properties.. Option C is correct because the existence condition only references the storage account encryption type; it does not include a condition for Cosmos DB. Option A is wrong because Cosmos DB does support CMK. Option B is wrong because the policy mode 'All' evaluates resource types not explicitly excluded. Option D is wrong because the policy already includes both resource types in the if condition.

Answer

The policy rule only includes 'Microsoft.Storage/storageAccounts' in the if condition; Cosmos DB is not evaluated because the policy definition is incomplete.

Answer

The policy mode is set to 'All', which excludes Cosmos DB resources.

Answer

Cosmos DB does not support customer-managed keys; the policy cannot be applied to that resource type.

Question 15

Your organization wants to use Microsoft Sentinel to detect and respond to threats. You need to ensure that Sentinel can ingest data from Azure Firewall logs. Which three components are required? (Choose three.)

Accepted Answer

Enable diagnostic logs on Azure Firewall.. Options A, D, and E are correct. Option A is correct because Azure Firewall must have diagnostic logs enabled. Option D is correct because a Log Analytics workspace is needed to store the logs. Option E is correct because the Azure Firewall data connector in Sentinel pulls the logs. Option B is wrong because the Log Analytics agent is not used for Azure Firewall; it uses diagnostic settings. Option C is wrong because Azure Policy is not required for ingestion.

Answer

Assign an Azure Policy to enforce diagnostic logs on all firewalls.

Answer

Install the Log Analytics agent on the Azure Firewall.