AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel — 100 Questions

Question 1

An organization uses Microsoft Defender for Cloud to protect Azure virtual machines. They notice that several VMs are not receiving vulnerability assessment findings, even though they are in a scope where the integrated Qualys VA solution is enabled. What should they verify first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VM does not have the Log Analytics agent installed.. The integrated Qualys vulnerability assessment solution in Microsoft Defender for Cloud relies on the Log Analytics agent (or Azure Monitor Agent) to collect and forward vulnerability data from Azure VMs to the Qualys engine. Without this agent installed on a VM, the solution cannot perform scans or report findings, even if the VM is within an enabled scope. Therefore, verifying agent installation is the first troubleshooting step.

Answer

The VM is in a resource group that is excluded from the vulnerability assessment solution.

Answer

The VM is behind a network security group that blocks outbound traffic.

Answer

The VM does not have a valid Qualys license.

Question 2

A security analyst needs to create a custom alert in Microsoft Defender for Cloud that triggers when a user creates a public IP address in the 'production' resource group. Which type of alert should they use?

Accepted Answer

Custom recommendation based on Azure Policy. Microsoft Defender for Cloud can integrate with Azure Policy to create custom recommendations that trigger on specific resource creation events, such as a user creating a public IP address in the 'production' resource group. By defining a custom Azure Policy initiative that audits or denies public IP creation in that resource group, Defender for Cloud surfaces a recommendation as an alert. This approach leverages policy-driven governance to detect non-compliant configurations, which is the intended mechanism for custom security alerts in Defender for Cloud.

Answer

Azure Sentinel analytics rule

Answer

Azure Activity Log alert

Answer

Custom alert rule in Defender for Cloud

Question 3

An organization uses Microsoft Defender for Cloud to protect Azure SQL databases. They want to receive alerts when a SQL database is accessed from a suspicious location. What should they enable?

Accepted Answer

Enable Microsoft Defender for Cloud for Azure SQL databases. Microsoft Defender for Cloud provides unified security management and threat protection across hybrid cloud workloads, including Azure SQL databases. When enabled for Azure SQL databases, it includes anomaly detection capabilities that can trigger alerts for suspicious activities such as access from unusual locations, based on machine learning models that analyze database access patterns.

Answer

Enable Azure Firewall on the SQL server

Answer

Enable Azure SQL Database Advanced Threat Protection

Answer

Enable Azure SQL Database Auditing

Question 4

Your company uses Microsoft Sentinel to correlate data from multiple sources. You need to create an analytics rule that triggers an incident when a user signs in from an unfamiliar location and then performs a high-risk action in Azure. What is the best approach?

Accepted Answer

Create a Fusion analytics rule. The Fusion analytics rule is designed to correlate alerts from multiple Microsoft security products (e.g., Microsoft Defender for Identity, Microsoft Defender for Cloud Apps) to detect multi-stage attacks. In this scenario, the rule automatically matches a sign-in from an unfamiliar location (detected by Microsoft Defender for Identity) with a subsequent high-risk action in Azure (detected by Microsoft Defender for Cloud Apps) to create a single incident, reducing alert fatigue and providing context.

Answer

Run a custom anomaly detection job

Answer

Create a Scheduled analytics rule with a KQL query

Answer

Create a Near-Real-Time (NRT) analytics rule

Question 5

A security analyst needs to view all incidents generated by Microsoft Defender for Cloud across multiple subscriptions in a single pane of glass. What should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides a unified view of security posture and alerts across all subscriptions in a single dashboard. It aggregates security incidents generated by Defender for Cloud's threat detection capabilities, allowing analysts to monitor and respond to threats from a central location without needing to navigate between different subscription blades.

Answer

Azure Monitor

Answer

Azure Security Center

Answer

Microsoft Sentinel

Question 6

You need to ensure that Microsoft Sentinel can detect threats across your Azure environment, including virtual machines, network traffic, and user activities. Which TWO data sources should you connect?

Accepted Answer

Windows Security Events via AMA. Option A (Windows Security Events via AMA) is correct because connecting Windows Security Events through the Azure Monitor Agent (AMA) streams Security event logs from Azure and non-Azure virtual machines into the Log Analytics workspace that backs Microsoft Sentinel, enabling detection of host-level threats such as suspicious logons, privilege escalation, and process creation. Option E (Azure Activity) is correct because the Azure Activity connector ingests subscription-level control-plane events (resource creation, role assignments, policy changes) into Sentinel, which is required to detect suspicious administrative and user activities across the Azure environment. Option B (Azure DNS) is not selected because it only provides DNS query logs for detecting malicious domain resolution, not the VM, network, and user activity coverage the scenario requires. Option C (Office 365) is not selected because it covers Exchange, SharePoint, Teams, and other productivity workloads rather than Azure infrastructure and VM telemetry. Option D (Azure Firewall) is not selected because it supplies only firewall network flow and rule-hit logs, which alone do not satisfy the broader VM and user activity detection requirements.

Answer

Azure DNS

Answer

Office 365

Answer

Azure Firewall

Question 7

A company uses Microsoft Defender for Cloud's workload protection for Azure Storage. They want to receive alerts when there is suspicious access to blob storage. Which TWO features should they enable?

Accepted Answer

Microsoft Defender for Cloud for Storage. Option D (Microsoft Defender for Cloud for Storage) is correct because this is the workload protection plan that detects suspicious activity and anomalous access patterns against Azure Storage accounts, generating the security alerts the company wants. Option E (Diagnostic settings to send storage logs to a Log Analytics workspace) is correct because enabling diagnostic settings on the storage account streams control-plane and data-plane logs (such as StorageRead, StorageWrite, and StorageDelete) to a Log Analytics workspace, where Defender for Cloud and Log Analytics can correlate and surface suspicious blob access alerts. Option A (Azure Storage Firewall) is incorrect because it only restricts network access to the storage account via virtual network rules and IP allowlists; it does not generate alerts about suspicious access. Option B (Azure Defender for Storage) is incorrect as a distinct answer because it is the legacy name for the same capability already represented by the Microsoft Defender for Cloud for Storage plan in option D, so it is not a separate feature to enable. Option C (Azure Storage Encryption) is incorrect because encryption at rest (SSE) protects data confidentiality but does not detect or alert on suspicious access behavior.

Answer

Azure Storage Firewall

Answer

Azure Defender for Storage

Answer

Azure Storage Encryption

Question 8

You are deploying Microsoft Sentinel in a new Azure environment. Which THREE resources are required to deploy a Sentinel workspace?

Accepted Answer

Contributor permissions on the resource group. Option A is correct because deploying Microsoft Sentinel requires the user to have Contributor permissions on the resource group that contains the workspace, which grants the necessary rights to create and manage the Sentinel solution and its associated resources. Option B is correct because the Microsoft.OperationsManagement resource provider must be registered on the subscription before Sentinel can be onboarded, as it supports the Operations Management solution used by Sentinel. Option D is correct because Microsoft Sentinel is built on top of a Log Analytics workspace, which stores the ingested security data and is a mandatory prerequisite for enabling Sentinel. Option C is not required because Microsoft Defender for Cloud is a separate security service that can integrate with Sentinel but is not a prerequisite for deploying the workspace. Option E is not required because there is no Microsoft.Sentinel resource provider to register; Sentinel onboarding uses the Microsoft.OperationsManagement and Microsoft.SecurityInsights resource providers instead.

Answer

Microsoft Defender for Cloud enabled

Answer

The Microsoft.Sentinel resource provider registered

Question 9

Refer to the exhibit. You are assigning this Azure Policy to a management group. The goal is to automatically deploy the Azure Monitor Agent to Windows VMs that do not have it. However, after assignment, you notice that the policy is not deploying the agent. What is the most likely reason?

Accepted Answer

The policy definition is incomplete; it lacks the deployment specification for the DeployIfNotExists effect.. A DeployIfNotExists policy requires a complete deployment template specification within the policy definition. Without the 'deployment' property containing the ARM template details (such as resource type, API version, and properties for deploying the Azure Monitor Agent extension), the policy cannot perform the remediation action. The policy assignment will evaluate compliance but will not trigger the deployment, resulting in the agent not being installed.

Answer

The effect parameter is set to 'AuditIfNotExists'.

Answer

The policy mode should be 'All' instead of 'Indexed'.

Answer

The policy is a built-in policy and cannot be assigned.

Question 10

A security analyst reports that Microsoft Sentinel is not receiving Windows Security Events from Azure VMs that have the Log Analytics agent installed. The agent shows as connected, and other data sources (e.g., performance counters) are flowing. What is the most likely cause?

Accepted Answer

The Windows Security Events connector is not configured to collect the required event IDs.. The Windows Security Events connector in Microsoft Sentinel requires specific event IDs to be collected; if the data collection rule or agent configuration does not include the required event IDs, the events won't be sent. Option A is wrong because the Microsoft Sentinel solution is installed at the workspace level, not on individual VMs, so its absence on the VM is irrelevant. Option B is wrong because if the agent is connected and other data flows, network connectivity (including port 443) is fine. Option C is wrong because an incorrect workspace key would prevent the agent from connecting entirely, but the agent shows as connected.

Answer

The Microsoft Sentinel solution is not installed on the VM.

Answer

The Azure VM has a network security group blocking port 443.

Answer

The Log Analytics workspace key is incorrect.

Question 11

Your organization uses Microsoft Defender for Cloud to assess regulatory compliance. You need to ensure that the compliance dashboard reflects the latest standards and that custom assessments are included. What should you do?

Accepted Answer

Add a custom regulatory compliance standard in Defender for Cloud.. Microsoft Defender for Cloud allows you to add custom regulatory compliance standards directly within the compliance dashboard. This enables you to include both built-in standards (e.g., SOC 2, ISO 27001) and custom assessments tailored to your organization's specific compliance requirements, ensuring the dashboard reflects the latest standards.

Answer

Configure Microsoft Purview compliance portal to include Azure subscriptions.

Answer

Use Azure Policy to apply custom definitions and assign to management groups.

Answer

Create an Azure Blueprint with custom policies.

Question 12

You are reviewing the Azure Policy definition shown in the exhibit. This policy is assigned to a subscription. Several VMs are non-compliant. What is the most likely reason for the non-compliance?

Accepted Answer

The VMs do not have the Azure Disk Encryption extension installed.. The Azure Policy definition in the exhibit likely targets the 'Disk Encryption' built-in policy, which checks whether Azure Disk Encryption (ADE) is enabled on VMs. ADE uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt OS and data disks. If VMs are non-compliant, it means the Azure Disk Encryption extension is not installed or not properly configured on those VMs.

Answer

The VMs are not backed up to Azure Backup.

Answer

The VMs have encryption at host enabled but not Azure Disk Encryption.

Answer

The VMs are missing critical Windows security patches.

Question 13

You are designing a Microsoft Sentinel deployment for a multinational company. The company requires that all security logs be retained for at least seven years for compliance. The solution must be cost-effective. Which THREE actions should you take?

Accepted Answer

Configure the Log Analytics workspace retention to two years for interactive queries.. Option C is correct because setting the Log Analytics workspace retention to two years keeps recent data available for interactive queries in Sentinel while avoiding the higher cost of retaining all data in the workspace for the full seven years. Option E is correct because exporting logs to Azure Blob Storage provides a low-cost, durable long-term retention tier that satisfies the seven-year compliance requirement beyond the two-year interactive window. Option D is correct because Azure Archive Storage is the most cost-effective storage tier for data that is rarely accessed, making it ideal for logs older than two years that must still be retained for compliance. Option A is not appropriate because Event Hubs is a streaming ingestion and routing service, not a cost-effective seven-year archival store. Option B is not appropriate because Azure SQL Database is far more expensive than Blob or Archive Storage for bulk long-term log retention and is not designed for that purpose.

Answer

Use continuous export to Azure Event Hubs for long-term storage.

Answer

Store logs in Azure SQL Database for seven years.

Question 14

Your company uses Microsoft Defender for Cloud to protect Azure resources. You need to enable the enhanced security features (formerly Azure Defender) for all supported resource types. Which TWO plans should you enable? (Choose TWO that apply.)

Accepted Answer

Servers. The Defender for Servers plan is one of the enhanced security plans in Microsoft Defender for Cloud that provides threat protection for Windows and Linux virtual machines, including integration with Microsoft Defender for Endpoint, vulnerability assessment, and file integrity monitoring. Option E (Cloud Security Posture Management (CSPM)) is correct because the Defender CSPM plan delivers enhanced posture management capabilities such as attack path analysis, cloud security explorer, and agentless scanning, and it is one of the paid enhanced security plans that replaced the former Azure Defender offering. Options B, C, and D are incorrect because Microsoft Entra ID (now Microsoft Entra ID) protection is configured through Microsoft Entra ID Protection, Microsoft 365 Defender is a separate product for email, identity, endpoint, and cloud app protection, and Microsoft Sentinel is a SIEM/SOAR solution — none of these are Defender for Cloud enhanced security plans that you enable within the Defender for Cloud environment.

Answer

Azure Active Directory

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Question 15

You execute the KQL query shown in the exhibit in Microsoft Sentinel. The query returns no results, but you know there have been high-severity malware alerts in the past week. What is the most likely issue?

Accepted Answer

The alert name is case-sensitive and does not exactly match 'Malware'.. KQL queries in Microsoft Sentinel are case-sensitive for string comparisons. The query likely uses a filter like `AlertName == 'Malware'`, but the actual alert name in the SecurityAlert table may be 'Malware' with exact casing. If the query uses a different case (e.g., 'malware' or 'MALWARE'), it will return no results even if high-severity malware alerts exist. This is a common pitfall when querying Sentinel's SecurityAlert table, where alert names are stored with specific casing.

Answer

The SecurityAlert table does not contain malware alerts.

Answer

The time range filter is incorrect.

Answer

There are no high-severity alerts in the past week.

Question 16

You deploy the Bicep template shown in the exhibit. After deployment, you check Microsoft Sentinel and find it is not enabled. The Log Analytics workspace and Defender for Cloud pricing plan are created successfully. What is the most likely reason Sentinel is not enabled?

Accepted Answer

The sentinel resource does not reference the workspace, so it is not linked.. Microsoft Sentinel requires an explicit resource definition that references the Log Analytics workspace via the `workspaceId` property. Without this linkage, the Sentinel resource is not connected to the workspace, and Sentinel remains disabled even if the workspace and Defender for Cloud pricing plan are deployed successfully.

Answer

The Defender for Cloud pricing tier is set to 'Standard' but should be 'Free' for Sentinel.

Answer

The workspace retention is set to 90 days, but Sentinel requires at least 180 days.

Answer

The Log Analytics workspace SKU is set to 'PerGB2018' but Sentinel requires 'PerNode'.

Question 17

A security engineer configures a Microsoft Sentinel analytics rule to detect anomalous sign-ins from unfamiliar locations. The rule uses the following KQL query: SigninLogs | where RiskLevelDuringSignIn == 'medium' or RiskLevelDuringSignIn == 'high' | summarize count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 1h). After enabling the rule, no alerts are generated even though the team expects many. What is the most likely cause?

Accepted Answer

The query groups by IP address and user, so true anomalies (new IPs) are not detected because they appear in separate groups.. The KQL query groups sign-in events by UserPrincipalName, IPAddress, and a 1-hour time bin. This means each unique combination of user and IP address is counted separately, so a user signing in from a new, unfamiliar IP address will create a new group rather than being flagged as an anomaly. The rule does not compare IP addresses against a baseline of familiar locations, which is why no alerts are generated despite expected anomalous sign-ins.

Answer

The analytics rule is disabled due to a pricing tier downgrade.

Answer

The rule's trigger threshold is set too high (e.g., 100 events).

Answer

The SigninLogs data connector is not properly configured and is ingesting data with a 24-hour delay.

Question 18

You need to ensure that all Azure storage accounts in your subscription are encrypted at rest using customer-managed keys (CMK). Which Azure Policy initiative should you assign to audit compliance?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark initiative includes the policy definition 'Storage accounts should use customer-managed key for encryption,' which audits whether storage accounts are configured with CMK. Assigning this initiative to your subscription enables continuous compliance evaluation against this requirement. The other benchmarks (NIST, ISO, CIS) do not natively include the specific CMK audit policy for Azure Storage.

Answer

NIST SP 800-53 Rev. 5

Answer

ISO 27001:2013

Answer

CIS Microsoft Azure Foundations Benchmark

Question 19

Your organization uses Microsoft Sentinel to monitor for ransomware attacks. You need to create a custom analytics rule that detects when a large number of files are encrypted within a short time window. Which KQL query should you use as the rule logic?

Accepted Answer

FileCreationEvents | where FileName endswith '.encrypted' | summarize count() by Computer, UserName, bin(TimeGenerated, 5m). It uses a `FileCreationEvents` table (representing file creation activity in Windows or Azure Monitor agent logs) and filters for files ending with `.encrypted`, a common extension used by ransomware. The query then summarizes the count per computer, user, and 5-minute time bin, which directly detects a large number of encrypted files in a short window—matching the detection requirement.

Answer

AzureActivity | where OperationName contains 'encrypt' | summarize count() by Resource

Answer

SecurityEvent | where EventID == 4688 | summarize count() by Computer, bin(TimeGenerated, 5m)

Answer

CommonSecurityLog | where DeviceEventClassID == 'ransomware' | summarize count() by DeviceName

Question 20

A security administrator needs to enable just-in-time (JIT) VM access for all Azure VMs in a subscription using Microsoft Defender for Cloud. What are the minimum permissions required to enable JIT on the VMs?

Accepted Answer

Security Admin on the subscription. The Security Admin role in Microsoft Defender for Cloud includes the specific permission to manage just-in-time (JIT) VM access policies, which is a subset of security policy management. This role allows the administrator to enable, configure, and manage JIT on VMs without granting broader management rights like Contributor or Owner. The Security Admin role is the minimum privileged role that includes the 'Microsoft.Security/justInTimePolicies/write' action required to enable JIT.

Answer

Contributor on the subscription

Answer

Reader on the subscription

Answer

Owner on the subscription