AZ-500 Practice Exam 65 — 20 Questions

Question 1

Your organization runs a critical application on Azure Virtual Machines (VMs) that processes credit card transactions. Compliance with PCI DSS requires that all cardholder data be encrypted at rest and that the encryption keys be stored in a FIPS 140-2 Level 3 validated hardware security module (HSM). You have chosen to use Azure Disk Encryption with customer-managed keys stored in Azure Key Vault Managed HSM. During a security review, you discover that the VMs are using unmanaged disks. You need to migrate them to managed disks without downtime and ensure that encryption is applied. You also need to maintain the existing encryption keys and ensure that the encryption set is in the same region as the VMs. What should you do?

Accepted Answer

Stop the VM, convert the unmanaged disks to managed disks using Azure CLI, then enable Azure Disk Encryption with the existing DES.. Azure Disk Encryption with managed disks requires a Disk Encryption Set (DES) that references the key in the HSM. You can convert unmanaged disks to managed disks by stopping the VM and using Azure CLI or PowerShell, then attaching the managed disk. To avoid downtime, you should perform the conversion during a maintenance window. Ensure the DES is in the same region as the VM. Option B is correct. Option A is incorrect because you cannot directly use Azure Disk Encryption on unmanaged disks with a DES; you must convert to managed disks first. Option C is incorrect because Azure Backup does not help with disk type conversion. Option D is incorrect because copying disks would create duplicates and require reconfiguration.

Answer

Copy the unmanaged disks to managed disks using AzCopy and then attach them to the VM while it is running.

Answer

Create a new VM with managed disks, attach the unmanaged disks as data disks, and enable Azure Disk Encryption with the existing DES.

Answer

Take a backup of the VMs using Azure Backup, restore them to managed disks, and enable encryption with a new DES.

Question 2

Your organization has an Azure Cosmos DB account that stores IoT telemetry data. The data is ingested from multiple devices and is time-sensitive. Security requirements mandate that all data be encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. You configure CMK for the Cosmos DB account. After a security incident, you need to revoke access to the data immediately by disabling the CMK in Key Vault. However, you find that data can still be read from Cosmos DB. You need to ensure that disabling the key renders the data inaccessible. What should you do?

Accepted Answer

Change the Cosmos DB account's default identity to a user-assigned managed identity and remove that identity's access to the Key Vault.. Option C is correct: Changing the default identity to a user-assigned managed identity and revoking its access to the Key Vault will disable the CMK and make the data inaccessible. Option A: Disabling the key version does not immediately revoke access; Cosmos DB caches the key. Option B: Deleting the key may be irreversible and does not guarantee immediate revocation. Option D: Rotating the key does not revoke the old key; data encrypted with the old key remains accessible.

Answer

Rotate the CMK to a new key version and update the Cosmos DB account to use the new key.

Answer

Delete the CMK from Key Vault.

Answer

Disable the specific key version used by Cosmos DB in Key Vault.

Question 3

Your organization uses Microsoft Defender for Cloud to secure a multi-subscription environment. You have a subscription named 'Prod' that hosts critical applications. The security team requires that any new resource group created in the Prod subscription must automatically be protected by Microsoft Defender for Cloud at the 'Defender for Servers' plan P2 level. You need to implement a solution that ensures this compliance without manual intervention. You consider using Azure Policy, Azure Blueprints, or management group settings. Which option should you choose?

Accepted Answer

Use a management group structure where the 'Prod' subscription is under a 'Production' management group, and enable the 'Defender for Servers' plan P2 at the management group level.. Option A is correct because management group inheritance applies to all subscriptions under that group; setting the plan at the management group level will apply to new subscriptions. Option B is wrong because Blueprints are deprecated in favor of deployment stacks and don't auto-apply to new resource groups. Option C is wrong because Azure Policy can enforce the plan but requires a policy definition that deploys the plan; however, the plan can be set at management group. Option D is wrong because tagging does not enable defender plans.

Answer

Create an Azure Blueprint that includes the 'Defender for Servers' plan P2 assignment and assign it to the 'Prod' subscription.

Answer

Use Azure Resource Manager tags on resource groups to indicate 'ProtectionRequired', and configure a custom automation runbook to enable the plan.

Answer

Create an Azure Policy definition that deploys the 'Defender for Servers' plan P2 and assign it to the 'Prod' subscription with scope 'resource group'.

Question 4

Your company has a hybrid environment with Azure resources and on-premises servers. You have deployed Microsoft Sentinel and connected it to Azure AD, Azure Activity Logs, and Windows Security Events from on-premises servers via the Log Analytics gateway. You need to create a workbook that shows the number of sign-ins from each country over the last 24 hours. The data source is the SigninLogs table. However, the workbook does not display any data. You verify that the Log Analytics workspace is receiving sign-in logs from Azure AD. Which of the following is the most likely reason the workbook shows no data?

Accepted Answer

The workbook's time range filter is set to 'Last 7 days' but the query uses a 24-hour filter incorrectly.. Option A is correct because workbook queries may have a time filter that defaults to a different range; the 'time' parameter in the query might be set incorrectly. Option B is wrong because the workspace is receiving logs. Option C is wrong because the gateway is for on-premises, not for Azure AD logs which go directly. Option D is wrong because KQL is required for workbooks.

Answer

The workbook uses a different visualization type that requires KQL.

Answer

The Log Analytics gateway is blocking the sign-in logs.

Answer

The Log Analytics workspace is not receiving sign-in logs from Azure AD.

Question 5

Your company uses Microsoft Defender for Cloud's 'Vulnerability Assessment' solution for Azure VMs. You have enabled the 'Microsoft Defender for Servers' plan and deployed the integrated Qualys agent. You need to view the vulnerability assessment findings for all VMs in a single dashboard in Microsoft Defender for Cloud. Which blade in the Defender for Cloud portal should you navigate to?

Accepted Answer

Recommendations. The 'Security alerts' blade shows security alerts, not vulnerability findings. The 'Recommendations' blade includes vulnerability assessment findings. Option B is correct. Option A is for alerts. Option C is for inventory. Option D is for regulatory compliance.

Answer

Inventory

Answer

Security alerts

Answer

Regulatory compliance

Question 6

Your company, Contoso Ltd., has a hybrid environment with 500 on-premises Windows servers and 200 Azure VMs. The Azure VMs are spread across multiple subscriptions. You need to implement a centralized security monitoring solution using Microsoft Sentinel. The requirements are:
- Collect security events from all on-premises servers.
- Collect Azure activity logs and VM logs from all Azure subscriptions.
- Detect and respond to threats using built-in and custom analytics.
- Automatically remediate common threats such as disabling compromised user accounts.
- Ensure compliance with regulatory standards (e.g., NIST 800-53).
- Minimize administrative overhead and cost.

What should you do?

Accepted Answer

Deploy Azure Arc on all on-premises servers. Use Azure Monitor Agent with Data Collection Rules to collect security events. Enable Microsoft Sentinel on a Log Analytics workspace. Configure analytics rules and automation rules with playbooks for remediation.. Option A is correct because it meets all requirements: deploy Azure Arc agent for on-premises servers to enable Azure Monitor Agent, use DCRs to collect logs, enable Sentinel analytics, and use automation rules with playbooks for remediation. Option B is wrong because legacy MMA is deprecated and doesn't support DCRs; also, Azure Automation runbooks are more complex than playbooks. Option C is wrong because enabling Defender for Cloud on all subscriptions is expensive and doesn't provide the same analytics as Sentinel. Option D is wrong because the Sentinel Free tier has limited features and no automation.

Answer

Install Microsoft Monitoring Agent on on-premises servers and connect to a Log Analytics workspace. Enable Sentinel. Use Azure Automation runbooks for remediation.

Answer

Enable Microsoft Defender for Cloud on all subscriptions and install Defender for Endpoint on all servers. Forward logs to a third-party SIEM.

Answer

Create a Log Analytics workspace and enable Sentinel on the Free tier. Use KQL queries for detection and manual remediation.

Question 7

You are a security analyst at Fabrikam Inc. You have deployed Microsoft Sentinel and connected it to Microsoft 365 Defender (formerly Microsoft Threat Protection). You have also enabled UEBA and set up analytics rules for detecting suspicious sign-ins. Recently, you noticed that some high-severity incidents from Microsoft 365 Defender are not appearing in Microsoft Sentinel. You have verified that the Microsoft 365 Defender connector is enabled and that incidents are being sent to the workspace. However, the incidents are not being created as Sentinel incidents. What is the most likely reason?

Accepted Answer

The 'Microsoft 365 Defender' incident creation rule in Microsoft Sentinel is disabled.. By default, Microsoft Sentinel can create incidents from Microsoft 365 Defender incidents, but the incident creation rule must be enabled. Option A is correct. Option B is incorrect because the connector does not need to be premium. Option C is incorrect because you can create incidents from M365 Defender incidents. Option D is incorrect because the analytics rule is for generating alerts, not for ingesting incidents.

Answer

The analytics rule for sign-in detection is conflicting with the Microsoft 365 Defender connector.

Answer

The Microsoft 365 Defender connector requires a premium license.

Answer

Microsoft Sentinel cannot create incidents from Microsoft 365 Defender incidents; only alerts can be ingested.

Question 8

Your organization has a complex Azure environment with multiple subscriptions, each containing hundreds of VMs and PaaS services. You are responsible for ensuring that all resources are monitored for security threats using Microsoft Defender for Cloud. The environment includes: - Subscription A: Production workloads, requires the highest security posture. - Subscription B: Development environment, has a lower security budget. - Subscription C: Shared services (e.g., DNS, Active Directory). You need to implement the most cost-effective security monitoring solution that meets the following requirements: - All subscriptions must be covered by Defender for Cloud. - Production subscription must have vulnerability assessment for VMs. - Development subscription does not need vulnerability assessment but must have basic CSPM. - Shared services subscription must have advanced threat protection for Azure SQL databases. - You must minimize administrative overhead and ensure that security policies are centrally managed. What should you do?

Accepted Answer

Enable the 'Defender Cloud Security Posture Management' (CSPM) plan on the management group that contains all subscriptions. Then, on Subscription A, enable the 'Defender for Servers' plan with vulnerability assessment. On Subscription C, enable the 'Defender for Azure SQL' plan. Leave Subscription B with only the CSPM plan.. Option A is correct because enabling the Defender CSPM plan provides basic CSPM and allows enabling specific plans per subscription. Option B is wrong because enabling all plans on Subscription A is not cost-effective for Dev. Option C is wrong because using only free tier does not meet the vulnerability assessment requirement. Option D is wrong because disabling Defender for Cloud on Dev is not allowed; they need basic CSPM.

Answer

Enable all Defender plans on the management group to cover all subscriptions, then disable vulnerability assessment on Subscription B via policy.

Answer

Enable the 'Defender for Servers' plan on Subscription A, 'Defender for Azure SQL' on Subscription C, and disable Defender for Cloud on Subscription B.

Answer

Enable only the free tier of Defender for Cloud on all subscriptions, then manually configure vulnerability assessment for VMs in Subscription A and advanced threat protection for SQL in Subscription C.

Question 9

Your organization uses Microsoft Sentinel for security operations. You need to create a custom analytics rule that triggers an incident when a user executes a suspicious PowerShell command on a Windows server. The logs are stored in the 'DeviceEvents' table from Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). The rule should run every 5 minutes. Which scheduling frequency and query period should you configure?

Accepted Answer

Run query every 5 minutes with a query period of 5 minutes. For a rule that runs every 5 minutes, the query period should be set to 5 minutes to avoid duplication. Option B is correct. Option A would cause overlapping queries. Option C and D are not suitable for a 5-minute frequency.

Answer

Run query every 10 minutes with a query period of 5 minutes

Answer

Run query every 5 minutes with a query period of 1 minute

Answer

Run query every 5 minutes with a query period of 10 minutes

Question 10

You are a security engineer for a multinational company with 5000 Azure VMs across multiple subscriptions. You have deployed Microsoft Sentinel to ingest logs from all VMs via the Log Analytics agent. You need to create a detection rule that identifies potential cryptocurrency mining activity based on network traffic patterns. The rule should trigger an incident when any single VM communicates with a known mining pool IP address over port 3333, 4444, or 8333 within a 5-minute window. Additionally, to reduce noise, the rule should only trigger if the same VM sends more than 10 such connections in that window. You have a custom KQL function that extends the CommonSecurityLog table with an 'IsMiningPool' boolean column. Which of the following approaches should you use to create the rule?

Accepted Answer

Use a scheduled query rule with the query: CommonSecurityLog | where IsMiningPool == true | summarize ConnectionCount = count() by SourceIP, DestinationPort | where ConnectionCount > 10.. Option A is correct because it uses the custom function to filter, sums connections per VM, and uses threshold of 10. Option B is wrong because it uses a simple threshold without aggregation. Option C is wrong because it looks for 10 different IPs, not connections. Option D is wrong because it doesn't use the custom function and instead uses a list, which is less maintainable.

Answer

Use a scheduled query rule with the query: CommonSecurityLog | where DestinationPort in (3333,4444,8333) | summarize ConnectionCount = count() by SourceIP | where ConnectionCount > 10.

Answer

Use a scheduled query rule with the query: CommonSecurityLog | where IsMiningPool == true | summarize UniqueDestIPs = dcount(DestinationIP) by SourceIP | where UniqueDestIPs > 10.

Answer

Use an NRT query rule with the query: CommonSecurityLog | where IsMiningPool == true | where count() > 10.

Question 11

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to create a custom analytics rule that detects when a user account is created in Microsoft Entra ID and then, within 24 hours, that account is granted a privileged role (e.g., Global Administrator). You have set up the necessary data connectors to ingest Microsoft Entra ID audit logs and sign-in logs into Sentinel. The rule should trigger an incident with high severity when this sequence occurs. Which KQL query should you use in the analytics rule?

Accepted Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated <= 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated > 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=leftouter (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated > 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].displayName == $right.TargetResources[0].displayName | where TimeGenerated <= 24h

Question 12

Your company has a Microsoft Sentinel workspace that ingests logs from multiple sources, including Azure Active Directory (now Microsoft Entra ID), Azure Firewall, and Microsoft 365 Defender. You are asked to create an analytics rule that detects when a user account is deleted from Microsoft Entra ID and then, within 24 hours, a large number of Azure resources are deleted in the same tenant. You have the following requirements: - The rule must use KQL to correlate events across two tables: AuditLogs (for user deletion) and ActivityLogs (for resource deletion). - The rule should trigger an incident only if more than 10 resources are deleted within 24 hours after the user deletion. - The incident severity should be set to 'High'. - The rule should run every hour and look back 24 hours. Which of the following is the correct KQL query for the analytics rule? (Choose the best option.)

Accepted Answer

let deletionTime = AuditLogs | where OperationName == 'Delete user' | project DeletionTime = TimeGenerated, UserPrincipalName; deletionTime | join kind=inner (ActivityLogs | where OperationName == 'Delete resource') on UserPrincipalName | where ActivityLogs_TimeGenerated between (DeletionTime .. DeletionTime + 24h) | summarize ResourceCount = count() by UserPrincipalName | where ResourceCount > 10. Option B is correct because it uses 'let' to define the user deletion time, then joins with ActivityLogs to count resource deletions within 24 hours. Option A is wrong because it does not filter for resource deletion operations. Option C is wrong because it uses 'summarize' incorrectly. Option D is wrong because it does not handle the time window correctly.

Answer

Answer

AuditLogs | where OperationName == 'Delete user' | join kind=inner (ActivityLogs) on $left.Caller == $right.Caller | where TimeGenerated < ActivityLogs_TimeGenerated and TimeGenerated + 24h > ActivityLogs_TimeGenerated | summarize ResourceCount = count() by UserPrincipalName | where ResourceCount > 10

Answer

Question 13

You are a security engineer for a large enterprise using Microsoft Sentinel. You have multiple workspaces deployed across different Azure regions to meet data residency requirements. You need to query data across all workspaces from a single query. You have set up a workspace as the 'central' workspace for cross-workspace queries. The central workspace has the necessary permissions to access the other workspaces. Which KQL operator should you use to include data from other workspaces in your query?

Accepted Answer

union. The 'union' operator can be used with a workspace expression to combine data from multiple workspaces. Option A is correct. Option B is for joining tables. Option C is for filtering. Option D is for creating subsets.

Answer

where

Answer

join

Answer

project

Question 14

Your company uses Microsoft Defender for Cloud's regulatory compliance dashboard to track compliance with the PCI DSS standard. You have enabled the PCI DSS initiative on the management group. The dashboard shows that some controls are 'Not started' even though you have implemented the required security configurations. You suspect that the assessment might not be running correctly. You need to ensure that the compliance assessments are triggered for all resources. The environment consists of: - 3 subscriptions under a management group. - All subscriptions have Defender for Cloud enabled with the CSPM plan. - The PCI DSS initiative was assigned at the management group level. - Some resources are in regions that do not support certain policy effects. What is the most likely reason for the 'Not started' status?

Accepted Answer

Some policies in the PCI DSS initiative use effects that are not supported in certain regions, causing the assessment to not run.. Option C is correct because the built-in PCI DSS initiative includes policies that may have effects not supported in all regions, causing assessment failures. Option A is wrong because the CSPM plan is already enabled. Option B is wrong because the initiative at management group should assess all subscriptions. Option D is wrong because the compliance dashboard uses assessments from policies, not manual checks.

Answer

The compliance dashboard only displays results if you manually run an assessment.

Answer

The PCI DSS initiative must be assigned to each subscription individually.

Answer

The Defender Cloud Security Posture Management (CSPM) plan is not enabled on all subscriptions.

Question 15

You are a security engineer for Contoso Ltd. The company has a hybrid environment with Azure VMs and on-premises servers running Windows Server 2022. You have enabled Microsoft Defender for Cloud's multi-cloud posture management for AWS and GCP. Recently, you deployed Microsoft Sentinel in a Log Analytics workspace named 'ContosoWorkspace'. The security team needs to centralize security alerts from all sources: Azure, on-premises, AWS, and GCP. They also require automated investigation and response for common threats. Specifically, they want to automatically disable a compromised user account when a high-severity alert is generated. You have configured data connectors for Azure Activity, Microsoft Entra ID, and AWS CloudTrail. For on-premises servers, you installed the Azure Monitor Agent (AMA) and enabled Defender for Cloud's plan for servers. For GCP, you are using the GCP Security Command Center connector. The team needs to create a playbook that runs when a high-severity alert from any source is triggered. The playbook should disable the user account in Microsoft Entra ID. You have created a playbook using Azure Logic Apps and granted it the necessary permissions. Which step should you take to ensure the playbook runs automatically when alerts are generated?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers the playbook when a high-severity alert is created.. To run a playbook automatically in response to alerts, you need to create an automation rule in Microsoft Sentinel that triggers the playbook when an alert is generated. Option B is correct. Option A is incorrect because analytics rules are for generating alerts, not for response. Option C is incorrect because playbooks are not created in Defender for Cloud. Option D is incorrect because the Logic App itself does not trigger on alerts without an automation rule.

Answer

Create an automation rule in Microsoft Defender for Cloud that triggers the playbook when a high-severity alert is generated.

Answer

Create an analytics rule in Microsoft Sentinel that triggers the playbook when a high-severity alert is created.

Answer

Configure the Logic App to run on a schedule and query Sentinel for high-severity alerts.

Question 16

You are the security engineer for a multinational company that uses Azure to host critical workloads. The company has deployed Microsoft Defender for Cloud with the enhanced security features enabled on all subscriptions. Recently, a security audit revealed that several virtual machines (VMs) in the production environment are missing critical security updates. The audit report indicates that the VMs are not being assessed for missing updates by Defender for Cloud. You need to ensure that all VMs are automatically assessed for missing OS updates using Defender for Cloud's vulnerability assessment capabilities. The solution must minimize administrative overhead and should not require manual installation of agents on existing VMs. What should you do?

Accepted Answer

Enable the 'Servers' plan in Defender for Cloud and ensure that the 'Vulnerability assessment for machines' setting is turned on.

Answer

Enable the 'SQL servers on machines' plan in Defender for Cloud.

Answer

Configure a vulnerability assessment solution from the Azure Marketplace and assign it to the VMs.

Answer

Deploy the Log Analytics agent to all VMs using Azure Policy.

Question 17

You are a security architect for Contoso, a global financial services company with 10,000 employees. Contoso uses Microsoft Entra ID (P2 licensed), Microsoft Intune, and Microsoft Defender for Cloud Apps. All corporate devices are enrolled in Intune and marked as compliant. The company is adopting Microsoft Copilot for Microsoft 365 to boost productivity. The security team requires that access to Copilot for Microsoft 365 be restricted to users who have completed the required training (confirmed by HR system). Additionally, any access to Copilot from unmanaged devices must be blocked. You need to design an access control solution that meets these requirements with minimal administrative overhead and without custom code. Which action should you take?

Accepted Answer

Create an access package in Microsoft Entra ID Governance that includes the Copilot for Microsoft 365 app, with a policy requiring a custom extension to verify training completion via the HR system, and configure Conditional Access to allow access only from compliant devices.. Option C is correct: Use Microsoft Entra ID Governance with Access Packages. This allows you to create an access package that requires a custom attribute (training completion) and automatically restricts access to managed devices via Conditional Access integration. Option A is wrong because PIM is for privileged roles, not user access to apps. Option B is wrong because dynamic groups do not enforce device compliance; they are for group membership. Option D is wrong because Identity Protection does not handle HR-based attributes or device compliance in one policy.

Answer

Create a dynamic group in Microsoft Entra ID based on the department attribute and assign the Copilot license to that group.

Answer

Use Microsoft Entra Identity Protection to create a risk policy that blocks access if the user's training is incomplete.

Answer

Configure Privileged Identity Management (PIM) for the Copilot for Microsoft 365 application, requiring approval for activation.

Question 18

You are the Azure Security Engineer for a financial services company. The company has a multi-tier application deployed on Azure Virtual Machines (VMs) in a hub-spoke network topology. The application consists of web servers, application servers, and database servers. The database servers run SQL Server on Windows Server 2022 and store sensitive financial data. Compliance requires that all data at rest be encrypted using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, all network traffic between tiers must be encrypted, and the database must be accessible only from the application servers. You have the following resources: a Key Vault with an HSM-backed key (key1) for disk encryption, and a Key Vault with a software-protected key (key2) for SQL Server TDE. Current configuration: The web servers are in subnet A, application servers in subnet B, and database servers in subnet C. Network Security Groups (NSGs) allow traffic from subnet B to subnet C on TCP 1433. The database servers are not using TDE. You need to implement the required security controls. What should you do first?

Accepted Answer

Enable Transparent Data Encryption (TDE) on the SQL Server instance using a service-managed key, then rotate to use key2 from Key Vault. Option C is correct because to use customer-managed keys for SQL Server TDE, you must first enable TDE with a service-managed key, then switch to the customer-managed key stored in Key Vault. Option A is wrong because Azure Disk Encryption encrypts the OS disk, not SQL Server data files. Option B is wrong because enabling SQL authentication does not provide encryption. Option D is wrong because Always Encrypted encrypts specific columns, not the entire database.

Answer

Enable Azure Disk Encryption on the database VMs using key1 from the HSM-backed Key Vault

Answer

Configure SQL Server to use SQL authentication and create a login for the application servers

Answer

Implement Always Encrypted for the sensitive columns using key2 from Key Vault

Question 19

You are a security architect for a large enterprise with 500 Azure subscriptions organized into a management group hierarchy. The company uses Microsoft Defender for Cloud to assess security posture. The CISO wants a single dashboard view of the secure score across all subscriptions, but with the ability to drill down into individual management groups. You need to recommend a solution that provides this capability with minimal administrative overhead. The company already has Log Analytics workspaces deployed per region. Which approach should you take?

Accepted Answer

Use the Microsoft Defender for Cloud dashboard in the Azure portal, selecting the root management group to view aggregated score. Option B is correct because the secure score is aggregated at the management group level in the Defender for Cloud dashboard; you can view the score per management group and drill down. Option A is wrong because exporting to a Log Analytics workspace is for advanced analytics, not for a quick dashboard view. Option C is wrong because the export API is for programmatic access, not a dashboard. Option D is wrong because Power BI integration requires additional setup and is not the simplest approach for a single dashboard.

Answer

Export the secure score to a Log Analytics workspace and create a custom workbook

Answer

Integrate Defender for Cloud with Microsoft Power BI and create a report

Answer

Use the Microsoft Defender for Cloud REST API to retrieve the secure score and build a custom dashboard

Question 20

You have an Azure Cosmos DB account that stores sensitive data. You need to ensure that all data in transit between the client application and Cosmos DB is encrypted using TLS 1.2 or higher. Additionally, you want to enforce that only Azure services within the same region can access the Cosmos DB account. What two configurations should you implement? (Choose two.)

Accepted Answer

Configure a private endpoint. Option B is correct because setting the minimum TLS version to 1.2 enforces encryption in transit. Option D is correct because using private endpoints ensures traffic stays within the Azure backbone and the same region. Option A (firewall with IP rules) allows traffic from specified IPs but not necessarily from Azure services. Option C (public network access disabled) is a prerequisite for private endpoints but not sufficient alone. Option E (service endpoint) does not enforce regional restriction.

Answer

Enable service endpoints for the Cosmos DB account

Answer

Disable public network access

Answer

Configure firewall rules to allow only Azure services