AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 11 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing the Microsoft Defender for Cloud settings for a subscription. The JSON shows that 'autoProvision' is set to true. What does this mean?

Accepted Answer

The Log Analytics agent is automatically installed on new Azure VMs. When 'autoProvision' is set to true in Microsoft Defender for Cloud, it means the Log Analytics agent (formerly Microsoft Monitoring Agent) is automatically installed on all existing and new Azure VMs in the subscription. This agent collects security-related telemetry and sends it to the Log Analytics workspace associated with Defender for Cloud, enabling threat detection and security monitoring. The setting does not enable any Defender plans or policies—it only controls agent deployment.

Answer

All Microsoft Defender plans are automatically enabled for new resources

Answer

Security policies are automatically assigned to new resource groups

Answer

Continuous export of security alerts is enabled

Question 2

Your organization has Microsoft Sentinel deployed in the East US region. You need to ensure that security logs are retained for 2 years to meet compliance requirements. The workspace retention policy is set to 90 days. What should you do?

Accepted Answer

Configure data retention for the specific tables that need long-term retention. Microsoft Sentinel allows you to configure table-level retention in Log Analytics workspaces, overriding the workspace default retention of 90 days. By setting the retention period to 730 days (2 years) on specific tables containing security logs, you meet compliance requirements without affecting other tables. This is the recommended approach for long-term retention of security data in Sentinel.

Answer

Change the workspace retention setting to 730 days

Answer

Use Azure Policy to enforce retention on the Log Analytics workspace

Answer

Export logs to an Azure Storage account and set a lifecycle management policy

Question 3

You are using Microsoft Defender for Cloud to protect Azure Kubernetes Service (AKS) clusters. You need to receive alerts about suspicious activities within the cluster, such as privilege escalations. What should you enable?

Accepted Answer

Microsoft Defender for Containers. Microsoft Defender for Containers is the correct solution because it provides threat detection for AKS clusters, including alerts for privilege escalations, suspicious process execution, and other runtime threats. It integrates directly with Defender for Cloud to monitor the Kubernetes audit logs and container workloads without requiring additional data connectors or agents.

Answer

Microsoft Sentinel with AKS data connector

Answer

Azure Policy for AKS

Answer

Azure Security Center (classic)

Question 4

You need to ensure that all Azure subscriptions in your tenant are automatically assessed for security misconfigurations and compliance against Microsoft cloud security benchmark. What should you configure?

Accepted Answer

Assign an initiative via Azure Policy to all subscriptions. The Microsoft cloud security benchmark is a built-in initiative in Azure Policy. By assigning this initiative to all subscriptions, you automatically assess them for security misconfigurations and compliance. Defender for Cloud uses these policies, but ensuring the assessment requires the initiative assignment. Option C is incorrect because enabling continuous export only streams completed assessment data; it does not trigger the assessment itself.

Answer

Deploy Microsoft Sentinel with automatic data connectors

Answer

Enable continuous export in Microsoft Defender for Cloud

Answer

Create a blueprint definition and assign it to management group

Question 5

You need to prioritize security recommendations in Microsoft Defender for Cloud. Your compliance team requires a framework that maps to regulatory standards. What should you use?

Accepted Answer

Regulatory compliance standards. Regulatory compliance standards in Microsoft Defender for Cloud map security recommendations to specific regulatory frameworks (e.g., SOC 2, PCI DSS, ISO 27001), enabling the compliance team to prioritize based on regulatory requirements. The secure score (Option D) provides an overall posture but does not map to specific standards. Azure Policy compliance dashboard (Option B) is used for policy enforcement, not recommendation prioritization. Inventory (Option C) lists resources without compliance mapping.

Answer

Azure Policy compliance dashboard

Answer

Inventory feature

Answer

Secure score

Question 6

You are designing a Microsoft Sentinel solution for a multinational company. The company requires that security incidents be correlated across regions, but data residency mandates require logs to remain in their original region. What should you implement?

Accepted Answer

Deploy one Microsoft Sentinel workspace per region and use cross-workspace querying for correlation. Deploying one Microsoft Sentinel workspace per region satisfies data residency mandates by keeping logs in their original region, while cross-workspace querying allows security incidents to be correlated across regions using KQL queries that span multiple workspaces. This approach ensures compliance with regional data sovereignty laws without sacrificing the ability to perform centralized threat detection and investigation.

Answer

Deploy a separate Log Analytics workspace per region, but only one Sentinel workspace

Answer

Deploy a single Microsoft Sentinel workspace in a central region and use Azure Lighthouse

Answer

Deploy a single Microsoft Sentinel workspace and use data collection rules to filter logs

Question 7

Your organization uses Microsoft Defender for Cloud to monitor Azure SQL databases. You receive an alert indicating a potential SQL injection attack. What is the most effective immediate action to validate and respond?

Accepted Answer

Review the SQL database auditing logs to identify the source queries. SQL database auditing logs capture detailed information about database events, including the exact SQL queries executed against the database. Reviewing these logs allows you to identify the source queries, the originating IP addresses, and the user accounts involved in the suspected SQL injection attack, enabling you to validate the alert and take targeted remediation actions. This is the most effective immediate step to confirm the attack and understand its scope before implementing broader security controls.

Answer

Enable Transparent Data Encryption (TDE) on the database

Answer

Run a vulnerability assessment on the database

Answer

Immediately block all IP addresses from the alert in the SQL firewall

Question 8

Your organization is migrating to Azure and needs to protect against advanced threats like fileless malware. You must use a solution that provides real-time protection and integrates with Microsoft Defender for Cloud. What should you deploy on Azure VMs?

Accepted Answer

Microsoft Defender for Endpoint (Microsoft Defender XDR). Microsoft Defender for Endpoint (part of Microsoft Defender XDR) provides next-generation protection, including behavior-based, real-time detection of fileless malware and other advanced threats. It integrates natively with Microsoft Defender for Cloud to deliver unified security management and automated response for Azure VMs, meeting the requirement for real-time protection against sophisticated attacks.

Answer

Microsoft Antimalware for Azure

Answer

Azure Monitor Agent (AMA)

Answer

Azure Security Center (free tier)

Question 9

You need to ensure that security alerts from Microsoft Defender for Cloud are sent to a central SIEM system. What should you configure?

Accepted Answer

Enable continuous export to Event Hubs. Microsoft Defender for Cloud can stream security alerts and recommendations to an Event Hubs namespace via the 'Continuous export' settings. This enables external SIEM systems, such as Splunk or Azure Sentinel, to ingest the data by connecting to the Event Hubs endpoint. Diagnostic settings export activity logs and metrics, not security alerts, and playbooks are for automated response, not data forwarding.

Answer

Create a playbook that forwards alerts to the SIEM

Answer

Configure diagnostic settings for the subscription

Answer

Assign an Azure Policy to export alerts

Question 10

Which THREE of the following are capabilities of Microsoft Defender for Cloud's workload protection plans?

Accepted Answer

Adaptive application controls. Adaptive application controls (A) are a capability of Microsoft Defender for Cloud's workload protection plans. They use machine learning to analyze processes running on Azure and non-Azure machines, allowing you to define allowlists for known safe applications and generate security alerts when unauthorized applications execute, thus reducing the attack surface.

Answer

DDoS protection

Answer

Data Loss Prevention (DLP)

Question 11

Your company has Microsoft Sentinel deployed in multiple workspaces across several Azure regions. The security operations team wants to query data from all workspaces centrally using a single KQL query. What feature should you implement?

Accepted Answer

Use cross-workspace queries with the workspace() expression in KQL.. The workspace() expression in KQL allows you to include tables from multiple Log Analytics workspaces in a single query, enabling centralized querying across all Microsoft Sentinel workspaces without moving or aggregating data. This is the native and recommended approach for cross-workspace queries in Azure Sentinel.

Answer

Configure Log Analytics workspaces as linked to a central workspace.

Answer

Export all data to Azure Data Explorer and query there.

Answer

Use the Microsoft Sentinel SIEM connector to aggregate data.

Question 12

You are configuring Microsoft Defender for Cloud to protect your Azure virtual machines. You need to enable just-in-time (JIT) VM access to reduce the attack surface. What prerequisite must be met?

Accepted Answer

Enable Microsoft Defender for Servers Plan 2.. Just-in-time (JIT) VM access in Microsoft Defender for Cloud requires Microsoft Defender for Servers Plan 2 to be enabled. This plan provides the advanced security capabilities, including JIT, vulnerability assessment, and file integrity monitoring. Without Plan 2, the JIT blade and policy options are not available, as Plan 1 only covers basic log collection and threat detection.

Answer

Configure Microsoft Defender for Cloud Apps with the VMs as connected.

Answer

Enable the Defender for Cloud 'JIT' plan.

Answer

Deploy Azure Bastion in the same virtual network.

Question 13

Your security team receives a high-priority alert from Microsoft Sentinel indicating a potential brute-force attack against an Azure SQL Database. The alert was generated by an analytics rule using the following KQL query: 'SigninLogs | where ResultType == "50057" | summarize Count = count() by UserPrincipalName, IPAddress | where Count > 10'. What is the most likely cause of the alert?

Accepted Answer

Multiple sign-in attempts using a disabled account from the same IP address.. The KQL query filters for ResultType == '50057', which specifically indicates 'User Account is Disabled'. The query then counts sign-in attempts by UserPrincipalName and IPAddress, triggering the alert when the count exceeds 10. This means the alert fires when there are more than 10 sign-in attempts from the same user and IP address against a disabled account, which matches the description of a brute-force attack targeting a disabled account.

Answer

Multiple failed MFA attempts by a user.

Answer

A user successfully signed in after many attempts.

Answer

Multiple sign-in attempts from a non-existent user account.

Question 14

You are designing a Microsoft Sentinel deployment for a multinational company. The company requires that data from different geographic regions be stored separately to comply with data residency laws. What is the recommended approach?

Accepted Answer

Deploy a separate Microsoft Sentinel workspace in each required region.. Microsoft Sentinel is built on top of Log Analytics workspaces, and each workspace is a distinct data container with its own retention, encryption, and geographic location. To comply with data residency laws that require data from different regions to be stored separately, you must deploy a separate Sentinel workspace in each required region. This ensures that data ingested from a specific region remains within that region's boundaries and is not mixed with data from other regions.

Answer

Deploy a single Sentinel workspace and use Azure Purview to tag data for residency.

Answer

Deploy a single Sentinel workspace and configure diagnostic settings to send data to separate Log Analytics workspaces.

Answer

Deploy a single Sentinel workspace and use data collection rules to route data to different storage accounts.

Question 15

You need to configure a continuous export of Microsoft Defender for Cloud alerts to a third-party SIEM. Which feature should you use?

Accepted Answer

Use the continuous export feature in Defender for Cloud to stream alerts to an Event Hubs namespace.. The continuous export feature in Microsoft Defender for Cloud is specifically designed to stream security alerts and recommendations to an Event Hubs namespace, which can then be consumed by a third-party SIEM. This native integration eliminates the need for custom polling or scripting, ensuring near real-time data flow with minimal latency.

Answer

Create an Azure Logic App to periodically query and send alerts.

Answer

Use the Defender for Cloud REST API to pull alerts.

Answer

Configure Azure Monitor agent on all VMs.