AZ-500 Practice Test 50 — 15 Questions

Question 1

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. The security team receives an alert about a critical vulnerability in an Azure VM that was remediated two weeks ago. What is the most likely reason the alert is still active?

Accepted Answer

The VM has not been rescanned after the remediation was applied.. Option C is correct because Defender for Cloud alerts are based on the latest vulnerability assessment scans; if the VM hasn't been rescanned since remediation, the alert remains. Option A is wrong because default policies don't suppress alerts. Option B is wrong because Silent Remediation suppresses alerts after remediation. Option D is wrong because alerts are not automatically dismissed after a time period.

Answer

The alert is a false positive due to a known issue in the vulnerability assessment engine.

Answer

The alert has a 30-day retention period and cannot be dismissed before that.

Answer

Silent Remediation was enabled, preventing the alert from being dismissed.

Question 2

A security engineer configures a Microsoft Sentinel analytics rule to detect anomalous sign-ins from unfamiliar locations. The rule uses the following KQL query: SigninLogs | where RiskLevelDuringSignIn == 'medium' or RiskLevelDuringSignIn == 'high' | summarize count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 1h). After enabling the rule, no alerts are generated even though the team expects many. What is the most likely cause?

Accepted Answer

The query groups by IP address and user, so true anomalies (new IPs) are not detected because they appear in separate groups.. Option B is correct because the query groups by UserPrincipalName, IPAddress, and hour; if the same user signs in from the same IP within the same hour, it's not anomalous. Option A is wrong because the rule is enabled. Option C is wrong because no aggregation threshold is set. Option D is wrong because the data connector might be slow but would still generate some alerts.

Answer

The analytics rule is disabled due to a pricing tier downgrade.

Answer

The rule's trigger threshold is set too high (e.g., 100 events).

Answer

The SigninLogs data connector is not properly configured and is ingesting data with a 24-hour delay.

Question 3

You need to ensure that all Azure storage accounts in your subscription are encrypted at rest using customer-managed keys (CMK). Which Azure Policy initiative should you assign to audit compliance?

Accepted Answer

Azure Security Benchmark. Option A is correct because Azure Security Benchmark includes a policy to audit storage accounts for CMK encryption. Option B is wrong because ISO 27001 doesn't specifically cover CMK. Option C is wrong because NIST SP 800-53 doesn't have a direct CMK audit policy. Option D is wrong because CIS Microsoft Azure Foundations Benchmark has a different scope.

Answer

NIST SP 800-53 Rev. 5

Answer

ISO 27001:2013

Answer

CIS Microsoft Azure Foundations Benchmark

Question 4

Refer to the exhibit. You assign this policy to a subscription that already has a security contact configured with email 'admin@contoso.com'. What will be the outcome?

Accepted Answer

The policy will not modify the existing security contact because it already exists.. Option A is correct because the policy only deploys if no security contact exists with a non-empty email. Since a contact exists, the policy will not modify it. Option B is wrong because the policy uses deployIfNotExists with existence check. Option C is wrong because the policy won't fail. Option D is wrong because the policy is not evaluated as non-compliant.

Answer

The policy will fail because the security contact already exists.

Answer

The subscription will become non-compliant because the email does not match.

Answer

The policy will overwrite the existing security contact with the one in the policy.

Question 5

Refer to the exhibit. A Microsoft Sentinel analytics rule uses this KQL query. What is the primary purpose of this rule?

Accepted Answer

Detect users with multiple risky sign-ins from non-US countries.. Option B is correct because the query filters for risky sign-ins from countries other than the US, and then counts them per user; limiting to >3 detects users with multiple risky sign-ins from non-US countries. Option A is wrong because it doesn't compare to previous behavior. Option C is wrong because it doesn't compare to other users. Option D is wrong because it doesn't look for impossible travel.

Answer

Detect users who have never signed in from the US before.

Answer

Detect impossible travel patterns between the US and other countries.

Answer

Detect users whose sign-in count is higher than the average for their region.

Question 6

You are investigating a security incident in Microsoft Sentinel. The incident involves multiple alerts from different data sources. You need to correlate the alerts to determine the full attack chain. Which Microsoft Sentinel feature should you use?

Accepted Answer

Incident investigation. Option B is correct because incident investigation allows you to visualize and correlate alerts, entities, and events. Option A is wrong because workbooks are for dashboards, not correlation. Option C is wrong because playbooks are for automated response. Option D is wrong because analytics rules create alerts, but correlation is done via investigation.

Answer

Analytics rules

Answer

Playbooks

Answer

Workbooks

Question 7

Your organization uses Microsoft Sentinel to monitor for ransomware attacks. You need to create a custom analytics rule that detects when a large number of files are encrypted within a short time window. Which KQL query should you use as the rule logic?

Accepted Answer

FileCreationEvents | where FileName endswith '.encrypted' | summarize count() by Computer, UserName, bin(TimeGenerated, 5m). Option D is correct because FileCreationEvents can capture file encryption events, and the query groups by host and user to detect a spike. Option A is wrong because SecurityEvent doesn't include file creation details. Option B is wrong because CommonSecurityLog is for firewall logs. Option C is wrong because AzureActivity doesn't capture file-level operations.

Answer

AzureActivity | where OperationName contains 'encrypt' | summarize count() by Resource

Answer

SecurityEvent | where EventID == 4688 | summarize count() by Computer, bin(TimeGenerated, 5m)

Answer

CommonSecurityLog | where DeviceEventClassID == 'ransomware' | summarize count() by DeviceName

Question 8

Which THREE are valid ways to ingest data into Microsoft Sentinel? (Choose three.)

Accepted Answer

Using the Azure Activity Log connector to stream subscription-level events.. Options A, B, and D are valid ingestion methods. Option C is wrong because Azure Policy is used for governance, not direct data ingestion. Option E is wrong because manual CSV upload is not a standard ingestion method; Sentinel uses connectors for structured data.

Answer

Uploading a CSV file manually via the Azure portal.

Answer

Using Azure Policy to assign initiatives that send compliance data to Sentinel.

Question 9

Your company uses Microsoft Defender for Cloud's Security Posture Management (CSPM) features. You need to identify resources that are not compliant with the organization's security baseline. What should you do?

Accepted Answer

Use the regulatory compliance dashboard. Option C is correct because the regulatory compliance dashboard shows compliance status against various standards, including custom baselines. Option A is wrong because secure score is an aggregate score, not a detailed compliance view. Option B is wrong because recommendations are individual findings, not a compliance overview. Option D is wrong because inventory shows resources, not compliance.

Answer

View the secure score

Answer

Review the security recommendations

Answer

Use the inventory blade

Question 10

You need to prioritize security recommendations in Microsoft Defender for Cloud. Your compliance team requires a framework that maps to regulatory standards. What should you use?

Accepted Answer

Regulatory compliance standards. Option D is correct because regulatory compliance standards in Defender for Cloud map recommendations to specific frameworks. Option A is wrong because secure score is for overall posture. Option B is wrong because Azure Policy is the underlying engine. Option C is wrong because inventory lists resources.

Answer

Azure Policy compliance dashboard

Answer

Inventory feature

Answer

Secure score

Question 11

Your company has Microsoft Sentinel deployed in multiple workspaces across several Azure regions. The security operations team wants to query data from all workspaces centrally using a single KQL query. What feature should you implement?

Accepted Answer

Use cross-workspace queries with the workspace() expression in KQL.. Option B is correct because cross-workspace queries in Sentinel allow running a single KQL query across multiple workspaces. Option A is wrong because Log Analytics workspaces are the data stores, not a query method across workspaces. Option C is wrong because Azure Data Explorer is not integrated natively for this purpose. Option D is wrong because the SIEM connector is for data ingestion, not for cross-workspace querying.

Answer

Configure Log Analytics workspaces as linked to a central workspace.

Answer

Export all data to Azure Data Explorer and query there.

Answer

Use the Microsoft Sentinel SIEM connector to aggregate data.

Question 12

Which TWO of the following are valid methods to ingest data into Microsoft Sentinel? (Select two.)

Accepted Answer

Using the Log Analytics agent to send custom logs.. Options B and D are correct. A connector is the standard way to ingest data from various sources. Custom logs using Log Analytics agents is also a valid method. Option A is wrong because PowerShell cmdlets do not directly ingest data into Sentinel. Option C is wrong because Azure Policy can enforce compliance but not ingest data. Option E is wrong because Power BI is a visualization tool, not data ingestion.

Answer

Using the Azure PowerShell cmdlets to send events directly.

Answer

Using Power BI to stream data.

Answer

Using Azure Policy to forward logs.

Question 13

You are configuring Microsoft Defender for Cloud's regulatory compliance dashboard. Your organization must comply with SOC 2. You have enabled the SOC 2 regulatory compliance standard. After a week, some controls show as 'Unhealthy'. What is the most likely reason for the 'Unhealthy' status?

Accepted Answer

The underlying Azure Policy initiatives have resources that are non-compliant.. Option B is correct because 'Unhealthy' in regulatory compliance means that the corresponding Azure Policy assessments have failed. Option A is wrong because if no resources were assessed, it would be 'Not registered'. Option C is wrong because the standard is enabled. Option D is wrong because the dashboard does not require manual attestation for SOC 2.

Answer

The standard is not fully enabled for all subscriptions.

Answer

The SOC 2 standard is not supported by Defender for Cloud.

Answer

You need to manually attest to the controls to mark them as healthy.

Question 14

You are responsible for securing an Azure environment using Microsoft Defender for Cloud. You need to reduce the number of false positive security alerts for a specific Azure SQL Database. The database is regularly scanned by a legitimate security tool that generates alerts. What should you do?

Accepted Answer

Create a suppression rule for the specific alert type and source IP address.. Option C is correct because creating a suppression rule in Defender for Cloud allows you to suppress alerts based on specific criteria like IP address or alert title, reducing false positives. Option A is wrong because disabling the alert rule would miss real threats. Option B is wrong because excluding the database from vulnerability assessment would also miss real vulnerabilities. Option D is wrong because modifying the firewall rules is not related to alert suppression.

Answer

Disable the security alert rule for SQL databases in Defender for Cloud.

Answer

Exclude the database from the vulnerability assessment solution.

Answer

Modify the Azure SQL Database firewall rules to allow the scanning tool's IP.

Question 15

Refer to the exhibit. You are reviewing a scheduled analytics rule in Microsoft Sentinel that uses the KQL query shown. The rule is configured to run every hour. A security analyst reports that the rule is generating too many incidents. What is the most likely cause?

Accepted Answer

The query does not filter out known safe IP addresses sufficiently.. Option B is correct because the query filters sign-in attempts from disabled accounts (ResultType 50057) in the last hour, but it only excludes two specific IP addresses. This means all other IP addresses (including legitimate ones) will trigger incidents, leading to many false positives. Option A is wrong because the query runs every hour, not too frequently. Option C is wrong because the query is valid. Option D is wrong because the query already filters by time.

Answer

The rule is configured to run too frequently.

Answer

The query uses 'ago(1h)' which includes data from the previous hour, causing duplicate incidents.

Answer

The query has a syntax error that causes all sign-ins to match.