AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 10 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to monitor Azure resources. You need to ensure that security recommendations are automatically remediated for non-compliant resources. Which TWO options can you use to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign an Azure Policy with a DeployIfNotExists effect that deploys the required configuration.. Option B is correct because an Azure Policy with a DeployIfNotExists effect automatically deploys the required configuration to non-compliant resources, which is the standard mechanism Defender for Cloud uses for automatic remediation at scale. Option D is correct because Defender for Cloud's 'Quick Fix!' feature provides one-click, automated remediation for supported recommendations, directly fixing non-compliant resources. Option A is incorrect because a scheduled Logic Apps playbook is not an automatic remediation trigger tied to non-compliance; playbooks in Defender for Cloud are triggered by alerts or recommendations, not schedules. Option C is incorrect because Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response, not the service that remediates Defender for Cloud compliance recommendations. Option E is incorrect because manually running Azure Automation runbooks is not automatic remediation, which the scenario explicitly requires.

Answer

Create a Logic Apps playbook that runs on a schedule.

Answer

Configure Microsoft Sentinel to automatically remediate based on alerts.

Answer

Use Azure Automation runbooks to manually run remediation.

Question 2

You run the PowerShell command shown in the exhibit. After execution, you check the Log Analytics workspace in the Azure portal. The workspace is created successfully. However, when you try to onboard the workspace to Microsoft Sentinel, you receive an error that Sentinel cannot be enabled on this workspace. What is the most likely cause?

Accepted Answer

The workspace is in a region that does not support Microsoft Sentinel.. Microsoft Sentinel is not available in all Azure regions. The error 'Sentinel cannot be enabled on this workspace' most commonly occurs when the Log Analytics workspace is deployed in a region that does not support Sentinel. Even though the workspace is created successfully, Sentinel requires specific regional availability, and if the workspace region is not in the supported list, onboarding will fail.

Answer

The SKU is set to PerGB2018, which is not compatible with Sentinel.

Answer

The resource group location is different from the workspace location.

Answer

The retention period is set to 365 days, which exceeds the maximum for Sentinel.

Question 3

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. The security team receives an alert about a critical vulnerability in an Azure VM that was remediated two weeks ago. What is the most likely reason the alert is still active?

Accepted Answer

The VM has not been rescanned after the remediation was applied.. The alert remains active because Microsoft Defender for Cloud relies on periodic vulnerability scans to update the security findings. Remediating the vulnerability on the VM does not automatically trigger a rescan; the alert status is only updated after the next scheduled scan or a manual rescan is initiated. Until the VM is rescanned, Defender for Cloud continues to display the previous vulnerable state.

Answer

The alert is a false positive due to a known issue in the vulnerability assessment engine.

Answer

The alert has a 30-day retention period and cannot be dismissed before that.

Answer

Silent Remediation was enabled, preventing the alert from being dismissed.

Question 4

Which TWO features are available in Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) capabilities? (Choose two.)

Accepted Answer

Attack path analysis. Attack path analysis is a CSPM capability in Microsoft Defender for Cloud that identifies the most likely sequences of actions an attacker could take to breach critical resources. It uses a graph-based model of your cloud environment to map dependencies and misconfigurations, enabling proactive risk mitigation. This is a core part of the Cloud Security Posture Management (CSPM) pillar, not a workload protection feature.

Answer

Just-in-time VM access

Answer

User and Entity Behavior Analytics (UEBA)

Answer

Vulnerability assessment for VMs

Question 5

Refer to the exhibit. You assign this policy to a subscription that already has a security contact configured with email 'admin@contoso.com'. What will be the outcome?

Accepted Answer

The policy will not modify the existing security contact because it already exists.. The Azure Policy definition shown uses the 'DeployIfNotExists' effect, which only deploys a resource (in this case, a security contact) if it does not already exist. Since the subscription already has a security contact configured with email 'admin@contoso.com', the policy will detect its presence and skip the deployment, leaving the existing contact unchanged. This behavior is by design to avoid overwriting existing configurations that may have been set manually or by other processes.

Answer

The policy will fail because the security contact already exists.

Answer

The subscription will become non-compliant because the email does not match.

Answer

The policy will overwrite the existing security contact with the one in the policy.

Question 6

Refer to the exhibit. A Microsoft Sentinel analytics rule uses this KQL query. What is the primary purpose of this rule?

Accepted Answer

Detect users with multiple risky sign-ins from non-US countries.. The KQL query filters sign-ins with risk level 'medium' or 'high' from countries other than the US, then counts them per user and filters for users with more than one such sign-in. This directly detects users who have multiple risky sign-ins from non-US countries, making option B correct. The rule does not consider historical sign-in patterns or averages, only the count of risky sign-ins outside the US.

Answer

Detect users who have never signed in from the US before.

Answer

Detect impossible travel patterns between the US and other countries.

Answer

Detect users whose sign-in count is higher than the average for their region.

Question 7

Your company, Contoso Ltd., has a hybrid environment with 500 on-premises Windows servers and 200 Azure VMs. The Azure VMs are spread across multiple subscriptions. You need to implement a centralized security monitoring solution using Microsoft Sentinel. The requirements are:
- Collect security events from all on-premises servers.
- Collect Azure activity logs and VM logs from all Azure subscriptions.
- Detect and respond to threats using built-in and custom analytics.
- Automatically remediate common threats such as disabling compromised user accounts.
- Ensure compliance with regulatory standards (e.g., NIST 800-53).
- Minimize administrative overhead and cost.

What should you do?

Accepted Answer

Deploy Azure Arc on all on-premises servers. Use Azure Monitor Agent with Data Collection Rules to collect security events. Enable Microsoft Sentinel on a Log Analytics workspace. Configure analytics rules and automation rules with playbooks for remediation.. It uses Azure Arc to onboard the 500 on-premises Windows servers into Azure, then Azure Monitor Agent (AMA) with Data Collection Rules (DCRs) to collect Windows security events into a Log Analytics workspace where Microsoft Sentinel is enabled; Sentinel's analytics rules provide built-in and custom threat detection, and automation rules with playbooks (Logic Apps) deliver automated remediation such as disabling compromised accounts, while Sentinel's compliance workbook and built-in NIST 800-53 content address regulatory requirements. This approach centralizes monitoring across all subscriptions and on-premises servers with minimal administrative overhead. Option A is outdated because the Microsoft Monitoring Agent (MMA) is deprecated in favor of AMA, and it lacks the Arc-based onboarding and DCR-based collection needed for modern hybrid coverage. Option B does not meet the requirement for Microsoft Sentinel, since it forwards logs to a third-party SIEM instead. Option C relies on manual remediation and the Sentinel Free tier, which has limited data ingestion and retention, so it does not satisfy automated remediation or compliance needs.

Answer

Install Microsoft Monitoring Agent on on-premises servers and connect to a Log Analytics workspace. Enable Sentinel. Use Azure Automation runbooks for remediation.

Answer

Enable Microsoft Defender for Cloud on all subscriptions and install Defender for Endpoint on all servers. Forward logs to a third-party SIEM.

Answer

Create a Log Analytics workspace and enable Sentinel on the Free tier. Use KQL queries for detection and manual remediation.

Question 8

You are a security analyst using Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from the same IP address within 5 minutes. The rule should use a KQL query. Which query should you use?

Accepted Answer

SigninLogs | where ResultType !in ("0","50125") // failed attempts | summarize Count = count() by IPAddress, bin(TimeGenerated, 5m) | where Count > 10. It filters for failed sign-ins by excluding successful results (ResultType '0' and '50125', where '50125' is a non-failure code), then uses `summarize` with `bin(TimeGenerated, 5m)` to count failed attempts per IP address within 5-minute windows, and finally filters for counts exceeding 10. This directly meets the requirement to trigger an incident when more than 10 failed sign-ins occur from the same IP within 5 minutes.

Answer

SigninLogs | where ResultType != "0" | make-series Count=count() default=0 on TimeGenerated from ago(5m) to now() step 5m by IPAddress

Answer

SigninLogs | where ResultType == "0" | summarize Count = count() by IPAddress, bin(TimeGenerated, 5m) | where Count > 10

Answer

SigninLogs | where ResultType == "0" | summarize Count = count() by IPAddress, bin(time-generated, 5m) | where Count > 10

Question 9

Your organization has multiple Azure subscriptions managed by Microsoft Defender for Cloud. You need to ensure that all subscriptions have the same security policies applied, and that any new subscription automatically inherits these policies. What should you do?

Accepted Answer

Assign a policy initiative at the management group level. Assigning a policy initiative at the management group level ensures that all subscriptions within that management group inherit the same security policies. When a new subscription is added to the management group, it automatically receives the assigned initiative, meeting the requirement for consistent and automatic inheritance. This is the most efficient and scalable approach for managing multiple subscriptions in Microsoft Defender for Cloud.

Answer

Create an Azure Blueprint and assign it to each subscription

Answer

Assign a policy initiative to a resource group and then move subscriptions into that group

Answer

Assign a policy initiative to each subscription individually

Question 10

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). You need to collect sign-in logs and audit logs. Which data connector should you enable?

Accepted Answer

Azure Active Directory (now Microsoft Entra ID). The Microsoft Entra ID (now Microsoft Entra ID) data connector is the correct choice because it is specifically designed to ingest both sign-in logs and audit logs from Microsoft Entra ID into Microsoft Sentinel. This connector enables the collection of user sign-in activities and directory audit events, which are essential for security monitoring and incident detection.

Answer

Azure AD Identity Protection

Answer

Office 365

Answer

Azure AD Authentication

Question 11

Your company uses Microsoft Defender for Cloud to protect Azure resources. You notice that some Azure VMs are not showing any security recommendations. You verify that the VMs are running and have network connectivity. What is the most likely cause?

Accepted Answer

The Log Analytics agent is not installed on the VMs. Microsoft Defender for Cloud relies on the Log Analytics agent (or Azure Monitor Agent) to collect security-relevant data from Azure VMs, such as configuration settings, event logs, and vulnerability signals. Without this agent installed, Defender for Cloud cannot assess the VM's security posture, and therefore no security recommendations will be generated for that VM, even if the VM is running and has network connectivity.

Answer

The VMs are in a resource group that lacks the required Azure RBAC role

Answer

The VMs have a resource lock preventing policy evaluation

Answer

The VMs are in the Free tier of Defender for Cloud

Question 12

You are investigating a security incident in Microsoft Sentinel. The incident involves multiple alerts from different data sources. You need to correlate the alerts to determine the full attack chain. Which Microsoft Sentinel feature should you use?

Accepted Answer

Incident investigation. Incident investigation in Microsoft Sentinel is designed specifically for visualizing and correlating alerts within an incident to reconstruct the full attack chain. It provides a graphical map that links entities (e.g., IP addresses, user accounts, hosts) across alerts from different data sources, enabling you to trace the attacker's path step by step.

Answer

Analytics rules

Answer

Playbooks

Answer

Workbooks

Question 13

You are configuring Microsoft Sentinel to use a playbook for automated response to incidents. The playbook needs to block the source IP address of a malicious sign-in on the Azure Firewall. Which Microsoft Sentinel feature should the playbook use?

Accepted Answer

Azure Logic Apps. Microsoft Sentinel playbooks are built on Azure Logic Apps, which provide the workflow automation and connectors needed to orchestrate response actions like blocking an IP on Azure Firewall. Logic Apps can integrate with Azure Firewall via its REST API or the Azure Resource Manager connector to update firewall rules, making it the correct feature for this automated incident response task.

Answer

Azure Automation runbooks

Answer

Azure Functions

Answer

KQL queries

Question 14

Your company uses Microsoft Defender for Cloud's Security Posture Management (CSPM) features. You need to identify resources that are not compliant with the organization's security baseline. What should you do?

Accepted Answer

Use the regulatory compliance dashboard. The regulatory compliance dashboard in Microsoft Defender for Cloud provides a view of how your resources comply with specific security standards and baselines, such as the Microsoft Cloud Security Benchmark (MCSB) or custom regulatory frameworks. By selecting the appropriate compliance standard that matches your organization's security baseline, you can identify resources that are non-compliant with specific controls. This dashboard directly maps security assessments to compliance controls, making it the correct tool for identifying resources not meeting your baseline.

Answer

View the secure score

Answer

Review the security recommendations

Answer

Use the inventory blade

Question 15

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. The query returns a list of IP addresses that have attempted to sign in more than 10 times in the last day. You notice that the query does not filter out successful sign-ins. You need to modify the query to count only failed sign-in attempts. What should you add?

Accepted Answer

Add '| where ResultType != "0"' before the summarize. In Microsoft Sentinel, the KQL query for sign-in logs uses the 'ResultType' field to indicate success or failure. A 'ResultType' of '0' represents a successful sign-in, while any non-zero value indicates a failure. Therefore, to count only failed sign-in attempts, you must filter with '| where ResultType != "0"' before the summarize operator. Option D correctly applies this filter, excluding successful sign-ins and ensuring the count reflects only failures.

Answer

Add '| where Status == "Failure"' before the summarize

Answer

Add '| where Result == "Failure"' before the summarize

Answer

Add '| where ResultType == "0"' before the summarize