AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 11 — 15 Questions

Question 1

You are a security engineer for a multinational company with 5000 Azure VMs across multiple subscriptions. You have deployed Microsoft Sentinel to ingest logs from all VMs via the Log Analytics agent. You need to create a detection rule that identifies potential cryptocurrency mining activity based on network traffic patterns. The rule should trigger an incident when any single VM communicates with a known mining pool IP address over port 3333, 4444, or 8333 within a 5-minute window. Additionally, to reduce noise, the rule should only trigger if the same VM sends more than 10 such connections in that window. You have a custom KQL function that extends the CommonSecurityLog table with an 'IsMiningPool' boolean column. Which of the following approaches should you use to create the rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a scheduled query rule with the query: CommonSecurityLog | where IsMiningPool == true | summarize ConnectionCount = count() by SourceIP, DestinationPort | where ConnectionCount > 10.. It uses the custom 'IsMiningPool' function to filter traffic to known mining pools, then summarizes the count of connections per source IP and destination port, and applies a threshold of >10 connections. This matches the requirement: detect when a single VM communicates with a mining pool IP on the specified ports more than 10 times in a 5‑minute window. Option A is wrong because it does not use the custom function and only filters by destination ports, which would include non‑mining traffic. Option B is wrong because it counts unique destination IPs instead of total connections. Option D is wrong because it uses NRT (near‑real‑time) rule, which is not appropriate for an aggregation over a time window, and the syntax is invalid.

Answer

Use a scheduled query rule with the query: CommonSecurityLog | where DestinationPort in (3333,4444,8333) | summarize ConnectionCount = count() by SourceIP | where ConnectionCount > 10.

Answer

Use a scheduled query rule with the query: CommonSecurityLog | where IsMiningPool == true | summarize UniqueDestIPs = dcount(DestinationIP) by SourceIP | where UniqueDestIPs > 10.

Answer

Use an NRT query rule with the query: CommonSecurityLog | where IsMiningPool == true | where count() > 10.

Question 2

Your organization uses Microsoft Defender for Cloud to secure a multi-subscription environment. You have a subscription named 'Prod' that hosts critical applications. The security team requires that any new resource group created in the Prod subscription must automatically be protected by Microsoft Defender for Cloud at the 'Defender for Servers' plan P2 level. You need to implement a solution that ensures this compliance without manual intervention. You consider using Azure Policy, Azure Blueprints, or management group settings. Which option should you choose?

Accepted Answer

Use a management group structure where the 'Prod' subscription is under a 'Production' management group, and enable the 'Defender for Servers' plan P2 at the management group level.. Enabling 'Defender for Servers' plan P2 at the management group level applies to all subscriptions under that management group, including the 'Prod' subscription. This setting is inherited by new resource groups automatically, ensuring compliance without manual intervention. Option A is incorrect because Azure Blueprints are deprecated in favor of deployment stacks and do not automatically apply to new resource groups created after assignment. Option B is incorrect because tagging and automation runbooks require custom development and are not a standard compliance enforcement method; they also do not guarantee automatic protection for new resource groups. Option C is incorrect because while Azure Policy can deploy the plan via a DeployIfNotExists policy, it would need to be assigned at the subscription scope, not at the resource group scope, and management group inheritance is a more straightforward and built-in solution.

Answer

Create an Azure Blueprint that includes the 'Defender for Servers' plan P2 assignment and assign it to the 'Prod' subscription.

Answer

Use Azure Resource Manager tags on resource groups to indicate 'ProtectionRequired', and configure a custom automation runbook to enable the plan.

Answer

Create an Azure Policy definition that deploys the 'Defender for Servers' plan P2 and assign it to the 'Prod' subscription with scope 'resource group'.

Question 3

Refer to the exhibit. You are reviewing a custom Azure Policy definition that will be assigned to a subscription to audit storage accounts and Cosmos DB accounts. The policy is intended to check whether these resources use customer-managed keys (CMK) for encryption. However, when you test the policy assignment, it does not evaluate Cosmos DB accounts. What is the most likely reason?

Accepted Answer

The existence condition in 'auditIfNotExists' only checks for storage account encryption; it does not evaluate Cosmos DB encryption properties.. The policy definition uses an 'auditIfNotExists' effect, which requires an existence condition to check for a specific resource (e.g., encryption settings). The existence condition in the policy only references 'Microsoft.Storage/storageAccounts' and their encryption properties, so it does not evaluate Cosmos DB accounts. Even if the 'if' condition matches Cosmos DB, the 'auditIfNotExists' effect will not trigger because the existence condition is not defined for Cosmos DB encryption properties.

Answer

The policy rule only includes 'Microsoft.Storage/storageAccounts' in the if condition; Cosmos DB is not evaluated because the policy definition is incomplete.

Answer

The policy mode is set to 'All', which excludes Cosmos DB resources.

Answer

Cosmos DB does not support customer-managed keys; the policy cannot be applied to that resource type.

Question 4

Your security team has deployed Microsoft Sentinel. They need to create an analytics rule that uses a custom KQL query to detect failed logon attempts from a specific IP address range and automatically creates an incident with a severity of 'High'. Which rule type should they use?

Accepted Answer

Scheduled query rule. A Scheduled query rule in Microsoft Sentinel allows you to define a custom KQL query that runs at a specified interval, evaluate the results against a threshold, and automatically create an incident with a configurable severity. This is the only rule type that supports custom KQL queries for detecting specific patterns like failed logons from a given IP range and mapping them to a 'High' severity incident.

Answer

Anomaly rule

Answer

NRT (Near-Real-Time) analytics rule

Answer

Fusion rule

Question 5

Your organization uses Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) to assess security posture. You notice that a critical recommendation for enabling diagnostic logs on Azure Key Vault is not appearing for a specific subscription. You have confirmed that the subscription is onboarded to Defender for Cloud. What is the most likely cause?

Accepted Answer

The subscription is not enrolled in the Defender Cloud Security Posture Management (CSPM) plan.. The CSPM plan must be explicitly enabled at the subscription level in Defender for Cloud. Even if the subscription is onboarded to Defender for Cloud, the CSPM plan (formerly 'Defender for Cloud Security Posture Management') is a separate plan that must be enrolled. Without it, CSPM recommendations—including the one for enabling diagnostic logs on Key Vault—will not be generated, as CSPM is the engine that evaluates and surfaces those posture recommendations.

Answer

The Log Analytics workspace linked to Defender for Cloud does not contain the Key Vault diagnostics schema.

Answer

Diagnostic logs are disabled by default in the Azure subscription's activity log settings.

Answer

Key Vault does not support diagnostic logs; therefore, the recommendation is not applicable.

Question 6

Your company is using Microsoft Sentinel to monitor security events. You need to ensure that all incidents generated in Sentinel are automatically sent to a third-party ticketing system via a webhook. Which Sentinel feature should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created. The playbook can then use an HTTP action to call a webhook endpoint on the third-party ticketing system, sending the incident data automatically. This is the native, built-in mechanism for outbound event-driven integration with external systems.

Answer

Use a watchlist to map incidents to ticketing system IDs.

Answer

Create a workbook that exports incidents to the ticketing system.

Answer

Configure a data connector to the ticketing system.

Question 7

Your organization has a hybrid identity environment with Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You are using Microsoft Defender for Cloud to monitor security posture. You notice that the recommendation 'MFA should be enabled on accounts with owner permissions on your subscription' shows a status of 'Unhealthy' for some accounts, but those accounts already have Microsoft Entra Conditional Access policies requiring MFA. What is the most likely reason for the discrepancy?

Accepted Answer

Defender for Cloud evaluates the 'per-user' MFA state, which is separate from Conditional Access.. Microsoft Defender for Cloud evaluates the per-user MFA state (the MFA status configured per user in Microsoft Entra ID), which is separate from Conditional Access policies. Even if Conditional Access policies require MFA, the per-user MFA state might be disabled or not enforced, causing the recommendation to show as 'Unhealthy'. Option A is incorrect because the issue is not about policy scope; per-user MFA is independent of Conditional Access. Option B is incorrect because guest users can be subject to MFA requirements via Conditional Access. Option D is incorrect because the recommendation is based on Microsoft Entra ID MFA settings, not subscription IAM configuration.

Answer

The Conditional Access policies are not applied to all users; some users bypass MFA.

Answer

The accounts are guest users from another tenant; MFA cannot be enforced.

Answer

The recommendation requires MFA to be configured in the subscription's access control (IAM) blade.

Question 8

Your security team is investigating a potential data exfiltration incident. They have identified that a user has been downloading large amounts of data from Azure Blob Storage to an external IP address. You need to create a Microsoft Sentinel analytics rule that triggers when more than 1 GB of data is downloaded from a storage account in a single hour. Which KQL query should be the basis of the rule?

Accepted Answer

StorageBlobLogs | where OperationName == 'GetBlob' | summarize TotalGB = sum(ResponseBodySize) / 1073741824 by bin(TimeGenerated, 1h) | where TotalGB > 1. It sums the response body size in bytes, converts to gigabytes, groups by 1-hour bins, and filters for totals exceeding 1 GB. This matches the requirement of detecting more than 1 GB of data downloaded in a single hour. Option B is incorrect because it uses average instead of sum, which would not detect total volume. Option C is incorrect because it filters individual operations exceeding 1 GB, missing the cumulative total. Option D is incorrect because it counts operations, not data volume.

Answer

StorageBlobLogs | where OperationName == 'GetBlob' | summarize avg(ResponseBodySize) by bin(TimeGenerated, 1h) | where avg_ResponseBodySize > 1073741824

Answer

StorageBlobLogs | where OperationName == 'GetBlob' and ResponseBodySize > 1073741824

Answer

StorageBlobLogs | where OperationName == 'GetBlob' | summarize count() by bin(TimeGenerated, 1h) | where count_ > 1000

Question 9

Your company wants to use Microsoft Defender for Cloud's just-in-time (JIT) VM access to reduce the attack surface. You have enabled JIT for a set of VMs. A security administrator reports that they cannot connect via RDP even after requesting access. What is the most likely cause?

Accepted Answer

The administrator's source IP address is not in the allowed list for the JIT policy.. The most likely cause is that the administrator's source IP address is not included in the allowed list for the JIT policy. When a user requests JIT access, Defender for Cloud opens the specified ports (e.g., 3389 for RDP) only to the source IP addresses that are explicitly permitted in the policy. If the administrator's IP is not in the allowed list, the request may be approved but the network security group (NSG) or Azure Firewall rule will not include that IP, resulting in a connection failure.

Answer

The JIT policy is set at the subscription level and does not apply to individual VMs.

Answer

The VM is not located in a region that supports JIT.

Answer

The VM does not have the Azure VM agent installed.

Question 10

Refer to the exhibit. You assign this built-in policy to a resource group containing Linux VMs. The policy is intended to deploy the Log Analytics agent if it is missing. After the assignment, you notice that the policy does not evaluate any VMs and the compliance state is 'Not started'. What is the most likely reason?

Accepted Answer

The policy mode 'Indexed' requires a remediation task to be created; the policy only evaluates resources when a remediation task is triggered.. The built-in policy 'Deploy Log Analytics agent for Linux VMs' uses the 'Indexed' resource provider mode, which only evaluates compliance when a remediation task is triggered. Without creating a remediation task, the policy remains in 'Not started' state and never evaluates the VMs. This is a common behavior for policies that deploy extensions via 'deployIfNotExists' effect.

Answer

The policy parameter 'workspaceId' is not provided during assignment.

Answer

Built-in policies cannot be assigned directly to a resource group; they must be assigned to a management group.

Answer

The Log Analytics agent is already installed on all VMs.

Question 11

Your organization is using Microsoft Sentinel to centralize security data from multiple sources. You need to ensure that data from Azure Active Directory (now Microsoft Entra ID) logs is ingested. Which two of the following should you configure? (Choose two.)

Accepted Answer

Configure diagnostic settings in Microsoft Entra ID to stream audit and sign-in logs to a Log Analytics workspace.. Diagnostic settings in Microsoft Entra ID (formerly Azure AD) must be configured to stream audit logs and sign-in logs to a Log Analytics workspace. This is the underlying mechanism that makes the log data available for ingestion by Microsoft Sentinel. Without this streaming configuration, the data connector in Sentinel has no source from which to pull the logs.

Answer

Enable the Microsoft 365 Defender data connector in Sentinel.

Answer

Create a separate Log Analytics workspace for Microsoft Entra ID logs.

Answer

Install the Log Analytics agent on domain controllers.

Question 12

Your company is implementing Microsoft Defender for Cloud's Security Alerts. You need to ensure that alerts for critical severity are automatically sent to the security operations team via email and also create a ticket in ServiceNow. Which three actions should you take? (Choose three.)

Accepted Answer

Create a continuous export rule in Defender for Cloud to send alerts to an Event Hubs namespace.. Continuous export in Microsoft Defender for Cloud allows you to stream security alerts to an Event Hubs namespace, which is a prerequisite for integrating with external systems like ServiceNow. This export can be configured at the subscription level and includes all alerts, including critical severity ones, enabling real-time processing by downstream consumers.

Answer

Create a playbook in Microsoft Sentinel that triggers on alerts.

Answer

Install the Log Analytics agent on all VMs to collect security alerts.

Question 13

Your organization wants to use Microsoft Sentinel to detect and respond to threats. You need to ensure that Sentinel can ingest data from Azure Firewall logs. Which three components are required? (Choose three.)

Accepted Answer

Enable diagnostic logs on Azure Firewall.. Azure Firewall logs must be enabled via diagnostic settings to send data to a Log Analytics workspace. Without diagnostic logs, the firewall does not produce the necessary log data for Sentinel to ingest. This is the foundational step for log collection.

Answer

Assign an Azure Policy to enforce diagnostic logs on all firewalls.

Answer

Install the Log Analytics agent on the Azure Firewall.

Question 14

Your company is using Microsoft Sentinel for security operations. You need to create a threat intelligence (TI) feed that allows Sentinel to match indicators from an external source. Which three actions should you take? (Choose three.)

Accepted Answer

Upload threat intelligence indicators using the Threat Intelligence API or portal.. The Threat Intelligence API or portal is the native method to upload custom TI indicators directly into Microsoft Sentinel, enabling the platform to match these indicators against incoming logs and events. This action populates the ThreatIntelligenceIndicator table, which is essential for detection and correlation.

Answer

Create a watchlist containing the indicators.

Answer

Enable the Fusion rule to correlate TI indicators with other events.

Question 15

Your organization has a complex Azure environment with multiple subscriptions, each containing hundreds of VMs and PaaS services. You are responsible for ensuring that all resources are monitored for security threats using Microsoft Defender for Cloud. The environment includes: - Subscription A: Production workloads, requires the highest security posture. - Subscription B: Development environment, has a lower security budget. - Subscription C: Shared services (e.g., DNS, Active Directory). You need to implement the most cost-effective security monitoring solution that meets the following requirements: - All subscriptions must be covered by Defender for Cloud. - Production subscription must have vulnerability assessment for VMs. - Development subscription does not need vulnerability assessment but must have basic CSPM. - Shared services subscription must have advanced threat protection for Azure SQL databases. - You must minimize administrative overhead and ensure that security policies are centrally managed. What should you do?

Accepted Answer

Enable the 'Defender Cloud Security Posture Management' (CSPM) plan on the management group that contains all subscriptions. Then, on Subscription A, enable the 'Defender for Servers' plan with vulnerability assessment. On Subscription C, enable the 'Defender for Azure SQL' plan. Leave Subscription B with only the CSPM plan.. A: Wrong. Enabling all Defender plans on the management group would be unnecessarily expensive for the development subscription (Subscription B) that only needs basic CSPM. B: Correct. Enable 'Defender Cloud Security Posture Management' (CSPM) plan on the management group to provide basic CSPM for all subscriptions. Then enable 'Defender for Servers' plan with vulnerability assessment on Subscription A (production) and 'Defender for Azure SQL' plan on Subscription C (shared services). Subscription B only gets the CSPM plan, minimizing cost while meeting requirements. C: Wrong. Disabling Defender for Cloud on Subscription B does not meet the requirement that all subscriptions must be covered by Defender for Cloud and must have basic CSPM. D: Wrong. The free tier of Defender for Cloud does not provide vulnerability assessment for VMs or advanced threat protection for Azure SQL databases, so it fails to meet the requirements for Subscriptions A and C.

Answer

Enable all Defender plans on the management group to cover all subscriptions, then disable vulnerability assessment on Subscription B via policy.

Answer

Enable the 'Defender for Servers' plan on Subscription A, 'Defender for Azure SQL' on Subscription C, and disable Defender for Cloud on Subscription B.

Answer

Enable only the free tier of Defender for Cloud on all subscriptions, then manually configure vulnerability assessment for VMs in Subscription A and advanced threat protection for SQL in Subscription C.