AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 11 — 15 Questions

Question 1

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. You notice that a critical recommendation 'Vulnerabilities in virtual machines should be remediated' is showing a healthy status of 0% compliance. Which action should you take first to enable vulnerability assessment for all VMs?

Accepted Answer

Enable the 'Vulnerability assessment for VMs' setting in Defender for Cloud's environment settings.. Enabling the integrated Qualys or Microsoft Defender vulnerability assessment solution at the subscription level will automatically onboard all current and future VMs. Option A is wrong because manual installation is not scalable. Option B is wrong because enabling Defender for Servers plan P2 includes vulnerability assessment but may be more costly than needed. Option D is wrong because it only addresses a subset of VMs.

Answer

Install the Azure Monitor Agent on each VM and configure log collection.

Answer

Enable the 'Defender for Servers' plan P2 on the subscription.

Answer

Create a policy assignment to deploy the 'Configure machines to receive a vulnerability assessment provider' initiative.

Question 2

Your organization runs a critical application on an Azure VM that generates sensitive data. You need to ensure that only approved applications can execute on the VM to prevent malware. You have Microsoft Defender for Cloud enabled with the Defender for Servers plan P2. Which feature provides application control without requiring custom rules?

Accepted Answer

Enable Adaptive application controls in Defender for Cloud.. Microsoft Defender for Cloud's adaptive application controls use machine learning to analyze processes and create allowlists automatically. Option A is wrong because AppLocker requires manual configuration. Option B is wrong because Windows Defender Application Control (WDAC) requires policy creation. Option D is wrong because just-in-time VM access controls network access, not application execution.

Answer

Configure AppLocker via Group Policy.

Answer

Enable Just-in-time VM access on the VM.

Answer

Enable Windows Defender Application Control (WDAC) on the VM.

Question 3

You are evaluating Microsoft Defender for Cloud's cloud security posture management (CSPM) capabilities. You need to identify misconfigurations across your Azure, AWS, and GCP environments. What should you enable?

Accepted Answer

Enable the 'Defender for Cloud' multicloud connector for AWS and GCP.. Defender for Cloud's multicloud environment settings allow you to connect AWS and GCP accounts to Azure for unified CSPM. Option B is wrong because Azure Arc is for on-premises, not other clouds. Option C is wrong because Microsoft Sentinel is a SIEM, not CSPM. Option D is wrong because Policy is Azure-only.

Answer

Ingest logs from AWS and GCP into Microsoft Sentinel.

Answer

Create Azure Policy assignments for AWS and GCP resources.

Answer

Deploy Azure Arc on VMs in AWS and GCP.

Question 4

A security analyst reports that a high-priority alert in Microsoft Sentinel for 'Malware detected on VM' was closed without investigation. You need to ensure that all alerts of severity High and above cannot be closed without adding a comment. What should you configure in Sentinel?

Accepted Answer

Modify the 'Analytics rule settings' to require a closing comment for high severity.. Sentinel allows setting a 'minimum severity level' for closing comments in the analytics rule settings or via automation rules. Option B is wrong because playbooks automate response, not enforce comments. Option C is wrong because watchlists are for enrichment. Option D is wrong because user and entity analytics is for UEBA.

Answer

Enable UEBA (User and Entity Behavior Analytics) to track closure patterns.

Answer

Create an automation rule that sets the incident severity and requires a comment when closing.

Answer

Configure a playbook that checks for comments before closing.

Question 5

Refer to the exhibit. You are reviewing a policy assignment in Microsoft Defender for Cloud that deploys the Log Analytics agent to Azure VMs. The policy uses 'DeployIfNotExists' effect and specifies a workspace. However, newly created VMs are not showing the agent installed. What is the most likely cause?

Accepted Answer

The policy assignment does not have a managed identity assigned.. DeployIfNotExists policies require a managed identity to perform remediation. If the policy assignment does not have a managed identity, it cannot deploy the agent. Option A is wrong because 'Disabled' effect would not attempt deployment. Option B is wrong because the workspace location does not need to match. Option D is wrong because the agent can be deployed to multiple workspaces via policy.

Answer

The workspace ID is incorrect.

Answer

The policy effect is set to 'Disabled'.

Answer

The Log Analytics workspace is in a different region than the VMs.

Question 6

Your company has multiple Azure subscriptions and wants to use Microsoft Sentinel as a SIEM. You need to collect security events from all Azure VMs, including existing and future ones. What should you use?

Accepted Answer

Create an Azure Policy assignment to deploy the Log Analytics agent.. Azure Policy with DeployIfNotExists effect can automatically deploy the Log Analytics agent to all VMs in a subscription. Option A is wrong because manual installation is not scalable. Option C is wrong because Azure Automation DSC is for configuration management, not agent deployment. Option D is wrong because the Azure portal VM blade is manual.

Answer

Use the Azure portal to enable 'Security Center' on each VM.

Answer

Use Azure Automation Desired State Configuration (DSC) to push the agent.

Answer

Manually install the Log Analytics agent on each VM.

Question 7

You are configuring Microsoft Sentinel to detect a new type of ransomware that encrypts files and changes file extensions. You need to create a detection rule that generates an incident when the same pattern of file changes occurs on multiple hosts within a short time. Which rule type should you use?

Accepted Answer

NRT (Near-Real-Time) query rule.. NRT rules run queries every minute with near real-time latency and can correlate events across multiple hosts. Option A is wrong because scheduled rules run on a schedule and may miss correlation. Option C is wrong because ML behavior analytics is for UEBA. Option D is wrong because Fusion is for multi-stage attacks.

Answer

Microsoft Security incident creation rule (ML behavior analytics).

Answer

Scheduled query rule.

Answer

Fusion rule (advanced multistage attack detection).

Question 8

Your organization uses Microsoft Defender for Cloud to protect Azure SQL databases. You receive a recommendation that 'SQL databases should have vulnerability findings resolved'. You run a vulnerability assessment scan and find a high-severity finding about a missing firewall rule. How should you resolve this finding?

Accepted Answer

Add a firewall rule to the SQL server allowing traffic from the required IP addresses.. The vulnerability assessment identifies configuration issues like missing firewall rules. The correct action is to add a firewall rule to allow only necessary IP ranges. Option A is wrong because enabling Defender for Cloud does not fix existing findings. Option B is wrong because changing audit settings does not affect firewall. Option C is wrong because enabling Advanced Threat Protection does not resolve vulnerability findings.

Answer

Change the SQL database auditing settings to capture all events.

Answer

Enable Advanced Threat Protection for Azure SQL Database.

Answer

Enable the 'Defender for SQL' plan on the server.

Question 9

Your security team wants to use Microsoft Sentinel to investigate a compromised user account. They need to see the user's recent sign-in activity, Azure AD audit logs, and related alerts in a single dashboard. What feature in Sentinel should they use?

Accepted Answer

Use the Investigation graph to visually explore the user's activities.. Sentinel's investigation graph allows pivoting from a user entity to see related alerts, events, and activities. Option A is wrong because workbooks are custom dashboards, not entity-specific. Option B is wrong because analytics rules are for detection. Option D is wrong because the entity page is a static view, not a graph.

Answer

Create a workbook that queries sign-in logs and audit logs.

Answer

Navigate to the user's entity page in Sentinel.

Answer

Create an analytics rule to detect user anomalies.

Question 10

Which TWO actions should you take to integrate on-premises servers with Microsoft Defender for Cloud for unified security management? (Choose two.)

Accepted Answer

Install the Log Analytics agent on each server.. Deploying Azure Arc on on-premises servers allows them to be managed by Defender for Cloud. Installing the Log Analytics agent enables data collection. Option C is wrong because VPN is not required. Option D is wrong because Azure Stack HCI is for hyperconverged infrastructure, not general servers. Option E is wrong because Microsoft Endpoint Manager is for device management.

Answer

Migrate the servers to Azure Stack HCI.

Answer

Enroll the servers in Microsoft Intune.

Answer

Establish a site-to-site VPN connection to Azure.

Question 11

Which THREE are valid ways to trigger a playbook in Microsoft Sentinel? (Choose three.)

Accepted Answer

Manually from an incident by selecting 'Run playbook'.. Playbooks can be triggered automatically from alerts or incidents, and manually from incidents. Option A is wrong because playbooks cannot be triggered from watchlists. Option B is correct: automation rules can trigger playbooks on alert creation. Option C is correct: automation rules can trigger on incident creation. Option D is correct: analysts can manually run a playbook from an incident. Option E is wrong because playbooks are not triggered from entity pages directly.

Answer

From a watchlist item update.

Answer

From an entity page by clicking 'Investigate'.

Question 12

Which TWO security controls are automatically provided by enabling Microsoft Defender for Cloud's foundational CSPM (Cloud Security Posture Management) capabilities? (Choose two.)

Accepted Answer

Continuous assessment of Azure resources against the Microsoft cloud security benchmark.. Foundational CSPM provides continuous assessment and compliance against benchmarks like Azure Security Benchmark, and security recommendations for resources. Option C is wrong because JIT is part of enhanced security, not foundational. Option D is wrong because Firewall Manager is a separate service. Option E is wrong because vulnerability assessment requires enabling Defender plans.

Answer

Azure Firewall Manager integration.

Answer

Just-in-time (JIT) VM access.

Answer

Vulnerability assessment for VMs.

Question 13

You are a security engineer for a multinational company with 5000 Azure VMs across multiple subscriptions. You have deployed Microsoft Sentinel to ingest logs from all VMs via the Log Analytics agent. You need to create a detection rule that identifies potential cryptocurrency mining activity based on network traffic patterns. The rule should trigger an incident when any single VM communicates with a known mining pool IP address over port 3333, 4444, or 8333 within a 5-minute window. Additionally, to reduce noise, the rule should only trigger if the same VM sends more than 10 such connections in that window. You have a custom KQL function that extends the CommonSecurityLog table with an 'IsMiningPool' boolean column. Which of the following approaches should you use to create the rule?

Accepted Answer

Use a scheduled query rule with the query: CommonSecurityLog | where IsMiningPool == true | summarize ConnectionCount = count() by SourceIP, DestinationPort | where ConnectionCount > 10.. Option A is correct because it uses the custom function to filter, sums connections per VM, and uses threshold of 10. Option B is wrong because it uses a simple threshold without aggregation. Option C is wrong because it looks for 10 different IPs, not connections. Option D is wrong because it doesn't use the custom function and instead uses a list, which is less maintainable.

Answer

Use a scheduled query rule with the query: CommonSecurityLog | where DestinationPort in (3333,4444,8333) | summarize ConnectionCount = count() by SourceIP | where ConnectionCount > 10.

Answer

Use a scheduled query rule with the query: CommonSecurityLog | where IsMiningPool == true | summarize UniqueDestIPs = dcount(DestinationIP) by SourceIP | where UniqueDestIPs > 10.

Answer

Use an NRT query rule with the query: CommonSecurityLog | where IsMiningPool == true | where count() > 10.

Question 14

Your organization uses Microsoft Defender for Cloud to secure a multi-subscription environment. You have a subscription named 'Prod' that hosts critical applications. The security team requires that any new resource group created in the Prod subscription must automatically be protected by Microsoft Defender for Cloud at the 'Defender for Servers' plan P2 level. You need to implement a solution that ensures this compliance without manual intervention. You consider using Azure Policy, Azure Blueprints, or management group settings. Which option should you choose?

Accepted Answer

Use a management group structure where the 'Prod' subscription is under a 'Production' management group, and enable the 'Defender for Servers' plan P2 at the management group level.. Option A is correct because management group inheritance applies to all subscriptions under that group; setting the plan at the management group level will apply to new subscriptions. Option B is wrong because Blueprints are deprecated in favor of deployment stacks and don't auto-apply to new resource groups. Option C is wrong because Azure Policy can enforce the plan but requires a policy definition that deploys the plan; however, the plan can be set at management group. Option D is wrong because tagging does not enable defender plans.

Answer

Create an Azure Blueprint that includes the 'Defender for Servers' plan P2 assignment and assign it to the 'Prod' subscription.

Answer

Use Azure Resource Manager tags on resource groups to indicate 'ProtectionRequired', and configure a custom automation runbook to enable the plan.

Answer

Create an Azure Policy definition that deploys the 'Defender for Servers' plan P2 and assign it to the 'Prod' subscription with scope 'resource group'.

Question 15

Your company has a hybrid environment with Azure resources and on-premises servers. You have deployed Microsoft Sentinel and connected it to Azure AD, Azure Activity Logs, and Windows Security Events from on-premises servers via the Log Analytics gateway. You need to create a workbook that shows the number of sign-ins from each country over the last 24 hours. The data source is the SigninLogs table. However, the workbook does not display any data. You verify that the Log Analytics workspace is receiving sign-in logs from Azure AD. Which of the following is the most likely reason the workbook shows no data?

Accepted Answer

The workbook's time range filter is set to 'Last 7 days' but the query uses a 24-hour filter incorrectly.. Option A is correct because workbook queries may have a time filter that defaults to a different range; the 'time' parameter in the query might be set incorrectly. Option B is wrong because the workspace is receiving logs. Option C is wrong because the gateway is for on-premises, not for Azure AD logs which go directly. Option D is wrong because KQL is required for workbooks.

Answer

The workbook uses a different visualization type that requires KQL.

Answer

The Log Analytics gateway is blocking the sign-in logs.

Answer

The Log Analytics workspace is not receiving sign-in logs from Azure AD.