AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel — 40 Questions

Question 1

A company uses Microsoft Defender for Cloud to manage the security posture of multiple Azure subscriptions. The security team wants to ensure that all subscriptions are covered by the same Microsoft Defender for Cloud policy initiative, but one subscription is not showing compliance data. The subscription is in the same Azure AD tenant and has the same tags. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The subscription is not registered with the Microsoft.Security resource provider.. Microsoft Defender for Cloud relies on the Microsoft.Security resource provider to collect security configurations, apply policy initiatives, and report compliance data. If a subscription is not registered with the Microsoft.Security resource provider, Defender for Cloud cannot evaluate policies or generate compliance results, even if the subscription is in the same tenant and has identical tags. Registering the resource provider is a prerequisite for any Defender for Cloud functionality, including policy assignment and compliance reporting.

Answer

The user does not have Security Admin permissions on the subscription.

Answer

The subscription does not have any tags applied.

Answer

The subscription does not have the default policy initiative assigned.

Question 2

An organization uses Microsoft Defender for Cloud to protect Azure virtual machines. They notice that several VMs are not receiving vulnerability assessment findings, even though they are in a scope where the integrated Qualys VA solution is enabled. What should they verify first?

Accepted Answer

The VM does not have the Log Analytics agent installed.. The integrated Qualys vulnerability assessment solution in Microsoft Defender for Cloud relies on the Log Analytics agent (or Azure Monitor Agent) to collect and forward vulnerability data from Azure VMs to the Qualys engine. Without this agent installed on a VM, the solution cannot perform scans or report findings, even if the VM is within an enabled scope. Therefore, verifying agent installation is the first troubleshooting step.

Answer

The VM is in a resource group that is excluded from the vulnerability assessment solution.

Answer

The VM is behind a network security group that blocks outbound traffic.

Answer

The VM does not have a valid Qualys license.

Question 3

A security analyst needs to create a custom alert in Microsoft Defender for Cloud that triggers when a user creates a public IP address in the 'production' resource group. Which type of alert should they use?

Accepted Answer

Custom recommendation based on Azure Policy. Microsoft Defender for Cloud can integrate with Azure Policy to create custom recommendations that trigger on specific resource creation events, such as a user creating a public IP address in the 'production' resource group. By defining a custom Azure Policy initiative that audits or denies public IP creation in that resource group, Defender for Cloud surfaces a recommendation as an alert. This approach leverages policy-driven governance to detect non-compliant configurations, which is the intended mechanism for custom security alerts in Defender for Cloud.

Answer

Azure Sentinel analytics rule

Answer

Azure Activity Log alert

Answer

Custom alert rule in Defender for Cloud

Question 4

Your company uses Microsoft Sentinel to monitor security events. You need to detect brute-force attacks against Azure VMs that are not yet onboarded to Sentinel. What should you do?

Accepted Answer

Use the Windows Security Events connector via Azure Monitor Agent.. The Windows Security Events connector via Azure Monitor Agent can collect security event logs from Azure VMs, including failed logon attempts that indicate brute-force attacks. Since the VMs are not yet onboarded to Sentinel, this connector allows you to ingest their existing Windows Event Logs (specifically Event ID 4625 for failed logons) directly into Sentinel for detection and alerting.

Answer

Use the Office 365 connector to collect sign-in logs.

Answer

Use the Common Event Format connector to forward syslog.

Answer

Use the Azure Activity connector to collect sign-in logs.

Question 5

A security team uses Microsoft Defender for Cloud's regulatory compliance dashboard to track compliance with PCI DSS. They notice that some controls are marked as 'N/A' even though they have relevant resources. What is the most likely reason?

Accepted Answer

The resources are in a subscription that is not included in the scope of the compliance standard.. The most likely reason is that the resources are in a subscription that is not included in the scope of the compliance standard. In Microsoft Defender for Cloud, the regulatory compliance dashboard assesses resources based on the scope defined for each standard. If a subscription or resource group is not added to the scope, controls will appear as 'N/A' for that scope. Option A is incorrect because custom assessments are not required for built-in controls; the dashboard uses built-in assessments. Option B is incorrect because the compliance dashboard does not require a Microsoft Purview Compliance Manager license; it is part of Defender for Cloud. Option D is incorrect because manual claiming of compliance is not a feature; the dashboard automatically assesses resources based on the selected standard.

Answer

The resources do not have the required custom assessment.

Answer

The compliance dashboard requires a Microsoft Purview Compliance Manager license.

Answer

The resources have not been manually claimed as compliant.

Question 6

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory. Which two data connectors are necessary to collect sign-in logs and audit logs?

Accepted Answer

Azure Active Directory Sign-in logs and Azure Active Directory Audit logs. To collect sign-in logs and audit logs in Microsoft Sentinel, you need the Azure Active Directory Sign-in logs connector for sign-in activity and the Azure Active Directory Audit logs connector for directory changes and user management events. These two connectors directly correspond to the two log categories required by the question.

Answer

Azure Activity and Azure Active Directory Audit logs

Answer

Office 365 and Azure Active Directory Sign-in logs

Answer

Security Events and Azure Active Directory Sign-in logs

Question 7

An organization uses Microsoft Defender for Cloud to protect Azure SQL databases. They want to receive alerts when a SQL database is accessed from a suspicious location. What should they enable?

Accepted Answer

Enable Microsoft Defender for Cloud for Azure SQL databases. Microsoft Defender for Cloud provides unified security management and threat protection across hybrid cloud workloads, including Azure SQL databases. When enabled for Azure SQL databases, it includes anomaly detection capabilities that can trigger alerts for suspicious activities such as access from unusual locations, based on machine learning models that analyze database access patterns.

Answer

Enable Azure Firewall on the SQL server

Answer

Enable Azure SQL Database Advanced Threat Protection

Answer

Enable Azure SQL Database Auditing

Question 8

A security analyst needs to view all incidents generated by Microsoft Defender for Cloud across multiple subscriptions in a single pane of glass. What should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides a unified view of security posture and alerts across all subscriptions in a single dashboard. It aggregates security incidents generated by Defender for Cloud's threat detection capabilities, allowing analysts to monitor and respond to threats from a central location without needing to navigate between different subscription blades.

Answer

Azure Monitor

Answer

Azure Security Center

Answer

Microsoft Sentinel

Question 9

You need to ensure that Microsoft Sentinel can detect threats across your Azure environment, including virtual machines, network traffic, and user activities. Which TWO data sources should you connect?

Accepted Answer

Windows Security Events via AMA. A and E are correct. Windows Security Events via AMA (A) collect OS-level security events from VMs, and Azure Activity (E) provides management plane logs (e.g., resource creation, policy changes). B (Azure DNS) is not a standard Microsoft Sentinel data connector. C (Office 365) logs are for Microsoft 365 workloads, not Azure network traffic. D (Azure Firewall) logs are limited to firewall traffic, not broad network monitoring.

Answer

Azure DNS

Answer

Office 365

Answer

Azure Firewall

Question 10

A company uses Microsoft Defender for Cloud's workload protection for Azure Storage. They want to receive alerts when there is suspicious access to blob storage. Which TWO features should they enable?

Accepted Answer

Microsoft Defender for Cloud for Storage. Microsoft Defender for Cloud for Storage (formerly Azure Defender for Storage) is the dedicated threat protection plan that detects suspicious access patterns to blob storage, such as anonymous access, unusual authentication failures, or access from Tor exit nodes. It provides security alerts directly in Defender for Cloud without requiring additional log ingestion.

Answer

Azure Storage Firewall

Answer

Azure Defender for Storage

Answer

Azure Storage Encryption

Question 11

You are deploying Microsoft Sentinel in a new Azure environment. Which THREE resources are required to deploy a Sentinel workspace?

Accepted Answer

Contributor permissions on the resource group. Contributor permissions on the resource group are required because deploying a Log Analytics workspace and enabling Microsoft Sentinel involves creating and managing resources like the workspace itself, data connectors, and analytics rules. The Contributor role provides the necessary write access to deploy and configure these components within the target resource group, ensuring the deployment can proceed without permission errors.

Answer

Microsoft Defender for Cloud enabled

Answer

The Microsoft.Sentinel resource provider registered

Question 12

Refer to the exhibit. You are assigning this Azure Policy to a management group. The goal is to automatically deploy the Azure Monitor Agent to Windows VMs that do not have it. However, after assignment, you notice that the policy is not deploying the agent. What is the most likely reason?

Accepted Answer

The policy definition is incomplete; it lacks the deployment specification for the DeployIfNotExists effect.. A DeployIfNotExists policy requires a complete deployment template specification within the policy definition. Without the 'deployment' property containing the ARM template details (such as resource type, API version, and properties for deploying the Azure Monitor Agent extension), the policy cannot perform the remediation action. The policy assignment will evaluate compliance but will not trigger the deployment, resulting in the agent not being installed.

Answer

The effect parameter is set to 'AuditIfNotExists'.

Answer

The policy mode should be 'All' instead of 'Indexed'.

Answer

The policy is a built-in policy and cannot be assigned.

Question 13

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

To list the top 10 most frequent alert names along with their severity over the last 7 days.. The KQL query uses the `summarize` operator to group alerts by `AlertName` and `Severity`, then sorts by `count_` in descending order and takes the top 10 results. This produces a list of the 10 most frequent alert names along with their severity over the last 7 days, matching option B.

Answer

To list all alerts with severity 'High' in the last 7 days.

Answer

To list all alerts generated in the last 7 days.

Answer

To list the count of alerts per severity for the last 7 days.

Question 14

Your company has a hybrid environment with on-premises servers and Azure VMs. All resources are onboarded to Microsoft Defender for Cloud. You need to receive alerts when a critical vulnerability is detected on any server. The security team wants to minimize false positives. What should you configure?

Accepted Answer

Enable vulnerability assessment for servers via the integrated VA solution.. Microsoft Defender for Cloud's integrated vulnerability assessment (VA) solution, powered by Qualys or Microsoft Defender Vulnerability Management, continuously scans servers for known CVEs and generates security alerts when critical vulnerabilities are found. This directly meets the requirement to receive alerts on critical vulnerabilities while minimizing false positives, as the VA solution uses curated, verified vulnerability data rather than heuristic or behavioral detections that might produce noise.

Answer

Configure just-in-time VM access to reduce attack surface.

Answer

Enable adaptive application controls to detect unapproved software.

Answer

Enable file integrity monitoring on critical files.

Question 15

A security analyst reports that Microsoft Sentinel is not receiving Windows Security Events from Azure VMs that have the Log Analytics agent installed. The agent shows as connected, and other data sources (e.g., performance counters) are flowing. What is the most likely cause?

Accepted Answer

The Windows Security Events connector is not configured to collect the required event IDs.. The Windows Security Events connector in Microsoft Sentinel requires specific event IDs to be collected; if the data collection rule or agent configuration does not include the required event IDs, the events won't be sent. Option A is wrong because the Microsoft Sentinel solution is installed at the workspace level, not on individual VMs, so its absence on the VM is irrelevant. Option B is wrong because if the agent is connected and other data flows, network connectivity (including port 443) is fine. Option C is wrong because an incorrect workspace key would prevent the agent from connecting entirely, but the agent shows as connected.

Answer

The Microsoft Sentinel solution is not installed on the VM.

Answer

The Azure VM has a network security group blocking port 443.

Answer

The Log Analytics workspace key is incorrect.

Question 16

Your organization uses Microsoft Defender for Cloud to assess regulatory compliance. You need to ensure that the compliance dashboard reflects the latest standards and that custom assessments are included. What should you do?

Accepted Answer

Add a custom regulatory compliance standard in Defender for Cloud.. Microsoft Defender for Cloud allows you to add custom regulatory compliance standards directly within the compliance dashboard. This enables you to include both built-in standards (e.g., SOC 2, ISO 27001) and custom assessments tailored to your organization's specific compliance requirements, ensuring the dashboard reflects the latest standards.

Answer

Configure Microsoft Purview compliance portal to include Azure subscriptions.

Answer

Use Azure Policy to apply custom definitions and assign to management groups.

Answer

Create an Azure Blueprint with custom policies.

Question 17

You are investigating a security incident in Microsoft Sentinel. A KQL query returns results indicating that a user logged in from an IP address that is not in the organization's approved list. The user's account has been compromised. You need to automatically disable the user account in Microsoft Entra ID when such an alert is triggered. What should you configure?

Accepted Answer

Create a playbook in Microsoft Sentinel with a Logic Apps connector to Microsoft Entra ID.. Microsoft Sentinel can use playbooks, which are automated workflows built on Azure Logic Apps, to respond to security alerts. By creating a playbook triggered by a Sentinel alert, you can use the Microsoft Entra ID connector to automatically disable a compromised user account, providing a direct and integrated remediation action.

Answer

Configure an Azure Policy that disables the user account.

Answer

Use Microsoft Defender for Cloud to automatically disable the account.

Answer

Create a Power Automate flow triggered by the Sentinel alert.

Question 18

Your company has multiple Azure subscriptions. You need to centralize security alerts and incidents in a single dashboard for the security operations center (SOC) team. The solution should provide advanced analytics and threat detection. Which service should you use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that centralizes security alerts and incidents from multiple Azure subscriptions into a single dashboard. It provides advanced analytics, built-in threat detection, and AI-driven investigation capabilities, making it ideal for a SOC team requiring a unified view across the enterprise.

Answer

Azure Monitor

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Cloud

Question 19

You are configuring Microsoft Defender for Cloud's continuous export feature. You need to export security alerts and recommendations to a Log Analytics workspace for long-term retention and custom analysis. The export should include only high-severity alerts and recommendations. What should you do?

Accepted Answer

Enable continuous export in Defender for Cloud and select high-severity alerts and recommendations.. Microsoft Defender for Cloud's continuous export feature allows you to directly export security alerts and recommendations to a Log Analytics workspace with granular filtering by severity. This meets the requirement for long-term retention and custom analysis without additional services. Selecting 'high-severity' in the export configuration ensures only the specified alerts and recommendations are exported.

Answer

Set up Microsoft Sentinel to ingest Defender for Cloud alerts and then export to the workspace.

Answer

Configure diagnostic settings on each Azure resource to send logs to the workspace.

Answer

Use Azure Event Hubs to stream security alerts to the workspace.

Question 20

You are reviewing the Azure Policy definition shown in the exhibit. This policy is assigned to a subscription. Several VMs are non-compliant. What is the most likely reason for the non-compliance?

Accepted Answer

The VMs do not have the Azure Disk Encryption extension installed.. The Azure Policy definition in the exhibit likely targets the 'Disk Encryption' built-in policy, which checks whether Azure Disk Encryption (ADE) is enabled on VMs. ADE uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt OS and data disks. If VMs are non-compliant, it means the Azure Disk Encryption extension is not installed or not properly configured on those VMs.

Answer

The VMs are not backed up to Azure Backup.

Answer

The VMs have encryption at host enabled but not Azure Disk Encryption.

Answer

The VMs are missing critical Windows security patches.