AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 10 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel to monitor hybrid environments. You have a Log Analytics workspace that collects Windows security events. You need to create an analytics rule that triggers when a user account is created on any server, but you only want to generate an incident if the account creation occurs outside of business hours (9 AM - 5 PM). How should you configure the rule query?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use SecurityEvent where EventID = 4720 and TimeGenerated !between (9:00 and 17:00).. It uses `EventID = 4720` to identify user account creation events (Windows security event ID for account creation) and filters with `TimeGenerated !between (9:00 and 17:00)` to exclude business hours. This ensures the rule triggers only when a user account is created outside of 9 AM–5 PM, generating an incident as required.

Answer

Use SecurityEvent where AccountCreated and TimeGenerated !between (9:00 and 17:00).

Answer

Use SecurityEvent where AccountCreated and TimeGenerated between 9:00 and 17:00.

Answer

Use SecurityEvent where AccountCreated and then schedule the rule to run only during non-business hours.

Question 2

Which THREE components are required to enable Microsoft Defender for Cloud's just-in-time (JIT) VM access?

Accepted Answer

A network security group (NSG) associated with the VM's subnet or NIC.. JIT VM access requires a network security group (NSG) to be associated with the VM's subnet or NIC. The NSG is used to create and enforce time-bound rules that allow inbound traffic only during the requested access window, and without an NSG, JIT cannot control network traffic at the VM level.

Answer

Azure Bastion configured for the virtual network.

Answer

Azure Firewall deployed in the same region.

Question 3

Which TWO types of data can Microsoft Sentinel ingest from Microsoft Defender XDR?

Accepted Answer

Incidents from Microsoft Defender XDR.. Microsoft Sentinel can ingest incidents and alerts directly from Microsoft Defender XDR via the built-in connector. This integration allows Sentinel to correlate and respond to security events across the Microsoft 365 Defender suite, including Defender for Endpoint alerts. Option B is correct because incidents from Microsoft Defender XDR are a native data source for Sentinel. Option C is correct because alerts from Microsoft Defender for Endpoint are also ingested as part of the Defender XDR connector's data stream.

Answer

Raw Windows event logs from endpoints.

Answer

Azure AD sign-in logs.

Answer

Microsoft 365 audit logs.

Question 4

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. You notice that a critical recommendation 'Vulnerabilities in virtual machines should be remediated' is showing a healthy status of 0% compliance. Which action should you take first to enable vulnerability assessment for all VMs?

Accepted Answer

Enable the 'Vulnerability assessment for VMs' setting in Defender for Cloud's environment settings.. Enabling the 'Vulnerability assessment for VMs' setting in Defender for Cloud's environment settings is the correct first step because it activates the integrated vulnerability assessment solution (powered by Qualys or Microsoft Defender) at the subscription level, automatically onboarding all current and future VMs. Option A is incorrect because installing the Azure Monitor Agent alone does not enable vulnerability assessment; it only collects monitoring data. Option B is incorrect because while Defender for Servers Plan P2 does include vulnerability assessment, it is not the direct setting to enable the assessment itself and may incur additional cost. Option C is incorrect because a policy assignment would deploy the vulnerability assessment provider to existing VMs, but the recommended first step is to enable the setting at the subscription level to cover all VMs automatically.

Answer

Install the Azure Monitor Agent on each VM and configure log collection.

Answer

Enable the 'Defender for Servers' plan P2 on the subscription.

Answer

Create a policy assignment to deploy the 'Configure machines to receive a vulnerability assessment provider' initiative.

Question 5

Your organization runs a critical application on an Azure VM that generates sensitive data. You need to ensure that only approved applications can execute on the VM to prevent malware. You have Microsoft Defender for Cloud enabled with the Defender for Servers plan P2. Which feature provides application control without requiring custom rules?

Accepted Answer

Enable Adaptive application controls in Defender for Cloud.. Microsoft Defender for Cloud's adaptive application controls use machine learning to analyze processes running on your VMs and create allowlists automatically, enabling application control without custom rules. Option A is incorrect because AppLocker requires manual configuration via Group Policy. Option B is incorrect because Just-in-time VM access controls network access, not application execution. Option C is incorrect because Windows Defender Application Control (WDAC) requires creating and managing custom policies.

Answer

Configure AppLocker via Group Policy.

Answer

Enable Just-in-time VM access on the VM.

Answer

Enable Windows Defender Application Control (WDAC) on the VM.

Question 6

You are evaluating Microsoft Defender for Cloud's cloud security posture management (CSPM) capabilities. You need to identify misconfigurations across your Azure, AWS, and GCP environments. What should you enable?

Accepted Answer

Enable the 'Defender for Cloud' multicloud connector for AWS and GCP.. The Defender for Cloud multicloud connector is specifically designed to ingest security findings and configuration data from AWS and GCP into Microsoft Defender for Cloud's CSPM dashboard. This enables unified visibility and assessment of misconfigurations across Azure, AWS, and GCP environments without requiring agents or log ingestion into Sentinel.

Answer

Ingest logs from AWS and GCP into Microsoft Sentinel.

Answer

Create Azure Policy assignments for AWS and GCP resources.

Answer

Deploy Azure Arc on VMs in AWS and GCP.

Question 7

A security analyst reports that a high-priority alert in Microsoft Sentinel for 'Malware detected on VM' was closed without investigation. You need to ensure that all alerts of severity High and above cannot be closed without adding a comment. What should you configure in Sentinel?

Accepted Answer

Modify the 'Analytics rule settings' to require a closing comment for high severity.. Microsoft Sentinel's analytics rule settings include a 'Grouping' and 'Incident settings' section where you can configure 'Closure reason' and 'Closure comment' requirements. By modifying the analytics rule to require a closing comment for incidents of High severity and above, you enforce that analysts must provide a comment before closing any high-priority alert, preventing the scenario described.

Answer

Enable UEBA (User and Entity Behavior Analytics) to track closure patterns.

Answer

Create an automation rule that sets the incident severity and requires a comment when closing.

Answer

Configure a playbook that checks for comments before closing.

Question 8

Refer to the exhibit. You are reviewing a policy assignment in Microsoft Defender for Cloud that deploys the Log Analytics agent to Azure VMs. The policy uses 'DeployIfNotExists' effect and specifies a workspace. However, newly created VMs are not showing the agent installed. What is the most likely cause?

Accepted Answer

The policy assignment does not have a managed identity assigned.. The 'DeployIfNotExists' effect in Azure Policy requires a managed identity to perform remediation tasks, such as installing the Log Analytics agent. Without a managed identity assigned to the policy assignment, the policy can evaluate compliance but cannot execute the deployment action. This is the most likely cause because the policy is correctly configured but lacks the necessary identity to write resources (agent installation) to the VM.

Answer

The workspace ID is incorrect.

Answer

The policy effect is set to 'Disabled'.

Answer

The Log Analytics workspace is in a different region than the VMs.

Question 9

Your company has multiple Azure subscriptions and wants to use Microsoft Sentinel as a SIEM. You need to collect security events from all Azure VMs, including existing and future ones. What should you use?

Accepted Answer

Create an Azure Policy assignment to deploy the Log Analytics agent.. Azure Policy can automatically deploy the Log Analytics agent to all existing and future Azure VMs via the 'Deploy Log Analytics agent for Windows/Linux VMs' built-in policy. This ensures consistent security event collection for Microsoft Sentinel without manual intervention, scaling across multiple subscriptions and VM lifecycles.

Answer

Use the Azure portal to enable 'Security Center' on each VM.

Answer

Use Azure Automation Desired State Configuration (DSC) to push the agent.

Answer

Manually install the Log Analytics agent on each VM.

Question 10

You are configuring Microsoft Sentinel to detect a new type of ransomware that encrypts files and changes file extensions. You need to create a detection rule that generates an incident when the same pattern of file changes occurs on multiple hosts within a short time. Which rule type should you use?

Accepted Answer

NRT (Near-Real-Time) query rule.. D is correct because NRT (Near-Real-Time) query rules in Microsoft Sentinel are designed to detect patterns across multiple hosts within a short time window (typically 1–5 minutes) by running queries every minute and evaluating results against a threshold. This matches the requirement to generate an incident when the same file-change pattern occurs on multiple hosts rapidly, as NRT rules can aggregate events across hosts and trigger on a count threshold.

Answer

Microsoft Security incident creation rule (ML behavior analytics).

Answer

Scheduled query rule.

Answer

Fusion rule (advanced multistage attack detection).

Question 11

Your organization uses Microsoft Defender for Cloud to protect Azure SQL databases. You receive a recommendation that 'SQL databases should have vulnerability findings resolved'. You run a vulnerability assessment scan and find a high-severity finding about a missing firewall rule. How should you resolve this finding?

Accepted Answer

Add a firewall rule to the SQL server allowing traffic from the required IP addresses.. The vulnerability assessment finding about a missing firewall rule indicates that the SQL server is accessible from an overly broad range of IP addresses or lacks a necessary restriction. Adding a firewall rule to the SQL server that allows traffic only from the required IP addresses directly resolves the misconfiguration, reducing the attack surface. This aligns with the recommendation to remediate vulnerability findings by applying network access controls.

Answer

Change the SQL database auditing settings to capture all events.

Answer

Enable Advanced Threat Protection for Azure SQL Database.

Answer

Enable the 'Defender for SQL' plan on the server.

Question 12

Your security team wants to use Microsoft Sentinel to investigate a compromised user account. They need to see the user's recent sign-in activity, Azure AD audit logs, and related alerts in a single dashboard. What feature in Sentinel should they use?

Accepted Answer

Use the Investigation graph to visually explore the user's activities.. The Investigation graph in Microsoft Sentinel is specifically designed for security operations to visually explore and correlate activities related to a compromised entity, such as a user account. It automatically pulls in sign-in logs, Azure AD audit logs, and related alerts into a single interactive graph, allowing analysts to trace the scope of an incident without manual querying. This makes it the correct feature for the described need of a unified dashboard for investigation.

Answer

Create a workbook that queries sign-in logs and audit logs.

Answer

Navigate to the user's entity page in Sentinel.

Answer

Create an analytics rule to detect user anomalies.

Question 13

Which TWO actions should you take to integrate on-premises servers with Microsoft Defender for Cloud for unified security management? (Choose two.)

Accepted Answer

Install the Log Analytics agent on each server.. The Log Analytics agent (now the Azure Monitor Agent) is required to collect security events and performance data from on-premises servers and send it to the Log Analytics workspace used by Microsoft Defender for Cloud. This enables Defender for Cloud to apply security policies, detect threats, and provide unified security management across hybrid environments.

Answer

Migrate the servers to Azure Stack HCI.

Answer

Enroll the servers in Microsoft Intune.

Answer

Establish a site-to-site VPN connection to Azure.

Question 14

Which THREE are valid ways to trigger a playbook in Microsoft Sentinel? (Choose three.)

Accepted Answer

Manually from an incident by selecting 'Run playbook'.. Playbooks in Microsoft Sentinel can be triggered in three ways: manually from an incident by selecting 'Run playbook' (Option A), automatically from an automation rule when an incident is created (Option B), and automatically from an automation rule when an alert is created (Option E). Options C (from a watchlist item update) and D (from an entity page by clicking 'Investigate') are not valid triggers for playbooks.

Answer

From a watchlist item update.

Answer

From an entity page by clicking 'Investigate'.

Question 15

Which TWO security controls are automatically provided by enabling Microsoft Defender for Cloud's foundational CSPM (Cloud Security Posture Management) capabilities? (Choose two.)

Accepted Answer

Continuous assessment of Azure resources against the Microsoft cloud security benchmark.. Foundational CSPM in Microsoft Defender for Cloud provides continuous assessment of Azure resources against the Microsoft cloud security benchmark (option C) and generates security recommendations for resources (option D). These are included by default without any additional plans. Option A (Azure Firewall Manager integration) is a separate service, not part of foundational CSPM. Option B (Just-in-time VM access) is part of the enhanced security features requiring a Defender plan. Option E (Vulnerability assessment for VMs) also requires enabling a Defender plan for servers.

Answer

Azure Firewall Manager integration.

Answer

Just-in-time (JIT) VM access.

Answer

Vulnerability assessment for VMs.