AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 12 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to secure a multi-cloud environment that includes Azure, AWS, and GCP resources. You need to ensure that all resources are assessed against a consistent set of security standards. What should you configure first?

Accepted Answer

In Defender for Cloud, add a regulatory compliance standard such as 'Azure CIS 1.4.0' and enable continuous export for all connected clouds.. Option B is correct because regulatory compliance standards such as Azure CIS 1.4.0 can be applied across multicloud resources in Defender for Cloud. Option A is wrong because AWS Security Hub is a separate service, not integrated natively. Option C is wrong because Azure Policy is for Azure-only. Option D is wrong because Microsoft Sentinel is for SIEM, not compliance standards.

Answer

Connect the AWS and GCP accounts to AWS Security Hub and Google Security Command Center respectively, then enable Defender for Cloud's multicloud connector.

Answer

Create Azure Policy initiatives and assign them to the management groups that contain the multicloud resources.

Answer

Configure Microsoft Sentinel to ingest security findings from AWS and GCP, then create custom alerts for compliance deviations.

Question 2

Refer to the exhibit. You are reviewing a custom Azure Policy definition that will be assigned to a subscription to audit storage accounts and Cosmos DB accounts. The policy is intended to check whether these resources use customer-managed keys (CMK) for encryption. However, when you test the policy assignment, it does not evaluate Cosmos DB accounts. What is the most likely reason?

Accepted Answer

The existence condition in 'auditIfNotExists' only checks for storage account encryption; it does not evaluate Cosmos DB encryption properties.. Option C is correct because the existence condition only references the storage account encryption type; it does not include a condition for Cosmos DB. Option A is wrong because Cosmos DB does support CMK. Option B is wrong because the policy mode 'All' evaluates resource types not explicitly excluded. Option D is wrong because the policy already includes both resource types in the if condition.

Answer

The policy rule only includes 'Microsoft.Storage/storageAccounts' in the if condition; Cosmos DB is not evaluated because the policy definition is incomplete.

Answer

The policy mode is set to 'All', which excludes Cosmos DB resources.

Answer

Cosmos DB does not support customer-managed keys; the policy cannot be applied to that resource type.

Question 3

Your security team has deployed Microsoft Sentinel. They need to create an analytics rule that uses a custom KQL query to detect failed logon attempts from a specific IP address range and automatically creates an incident with a severity of 'High'. Which rule type should they use?

Accepted Answer

Scheduled query rule. Option B is correct because a Scheduled query rule allows custom KQL and automatic incident creation. Option A is wrong because NRT rules are for near-real-time but require simpler queries. Option C is wrong because Anomaly rules are based on ML. Option D is wrong because Fusion rules correlate multiple signals.

Answer

Anomaly rule

Answer

NRT (Near-Real-Time) analytics rule

Answer

Fusion rule

Question 4

Your organization uses Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) to assess security posture. You notice that a critical recommendation for enabling diagnostic logs on Azure Key Vault is not appearing for a specific subscription. You have confirmed that the subscription is onboarded to Defender for Cloud. What is the most likely cause?

Accepted Answer

The subscription is not enrolled in the Defender Cloud Security Posture Management (CSPM) plan.. Option A is correct because if the subscription is not using the Defender Cloud Security Posture Management (CSPM) plan, some recommendations may be missing. Option B is wrong because diagnostic logs are not disabled by default in the subscription. Option C is wrong because the recommendation is not based on Log Analytics. Option D is wrong because Key Vault diagnostics are a standard recommendation.

Answer

The Log Analytics workspace linked to Defender for Cloud does not contain the Key Vault diagnostics schema.

Answer

Diagnostic logs are disabled by default in the Azure subscription's activity log settings.

Answer

Key Vault does not support diagnostic logs; therefore, the recommendation is not applicable.

Question 5

Your company is using Microsoft Sentinel to monitor security events. You need to ensure that all incidents generated in Sentinel are automatically sent to a third-party ticketing system via a webhook. Which Sentinel feature should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Option B is correct because Automation rules can trigger a playbook that uses a webhook. Option A is wrong because workbooks are for visualization. Option C is wrong because Data connectors ingest data. Option D is wrong because Watchlists are for reference data.

Answer

Use a watchlist to map incidents to ticketing system IDs.

Answer

Create a workbook that exports incidents to the ticketing system.

Answer

Configure a data connector to the ticketing system.

Question 6

Your organization has a hybrid identity environment with Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You are using Microsoft Defender for Cloud to monitor security posture. You notice that the recommendation 'MFA should be enabled on accounts with owner permissions on your subscription' shows a status of 'Unhealthy' for some accounts, but those accounts already have Microsoft Entra Conditional Access policies requiring MFA. What is the most likely reason for the discrepancy?

Accepted Answer

Defender for Cloud evaluates the 'per-user' MFA state, which is separate from Conditional Access.. Option B is correct because Defender for Cloud checks the 'per-user' MFA state, not Conditional Access policies. Option A is wrong because MFA is enabled correctly. Option C is wrong because guest accounts are also subject to MFA requirements. Option D is wrong because the recommendation is based on Microsoft Entra ID data.

Answer

The Conditional Access policies are not applied to all users; some users bypass MFA.

Answer

The accounts are guest users from another tenant; MFA cannot be enforced.

Answer

The recommendation requires MFA to be configured in the subscription's access control (IAM) blade.

Question 7

Your security team is investigating a potential data exfiltration incident. They have identified that a user has been downloading large amounts of data from Azure Blob Storage to an external IP address. You need to create a Microsoft Sentinel analytics rule that triggers when more than 1 GB of data is downloaded from a storage account in a single hour. Which KQL query should be the basis of the rule?

Accepted Answer

StorageBlobLogs | where OperationName == 'GetBlob' | summarize TotalGB = sum(ResponseBodySize) / 1073741824 by bin(TimeGenerated, 1h) | where TotalGB > 1. Option D is correct because it sums the response body size in bytes and converts to GB, then filters above 1 GB. Option A is wrong because it uses average instead of sum. Option B is wrong because it uses count instead of sum. Option C is wrong because it only checks if any single operation exceeds 1 GB.

Answer

StorageBlobLogs | where OperationName == 'GetBlob' | summarize avg(ResponseBodySize) by bin(TimeGenerated, 1h) | where avg_ResponseBodySize > 1073741824

Answer

StorageBlobLogs | where OperationName == 'GetBlob' and ResponseBodySize > 1073741824

Answer

StorageBlobLogs | where OperationName == 'GetBlob' | summarize count() by bin(TimeGenerated, 1h) | where count_ > 1000

Question 8

Your company wants to use Microsoft Defender for Cloud's just-in-time (JIT) VM access to reduce the attack surface. You have enabled JIT for a set of VMs. A security administrator reports that they cannot connect via RDP even after requesting access. What is the most likely cause?

Accepted Answer

The administrator's source IP address is not in the allowed list for the JIT policy.. Option A is correct because JIT only opens ports for approved source IPs; if the administrator's IP is not approved, access is denied. Option B is wrong because JIT does not require the VM to be in a specific location. Option C is wrong because the JIT policy can be set per VM. Option D is wrong because the VM agent is used for other purposes, not JIT approval.

Answer

The JIT policy is set at the subscription level and does not apply to individual VMs.

Answer

The VM is not located in a region that supports JIT.

Answer

The VM does not have the Azure VM agent installed.

Question 9

Refer to the exhibit. You assign this built-in policy to a resource group containing Linux VMs. The policy is intended to deploy the Log Analytics agent if it is missing. After the assignment, you notice that the policy does not evaluate any VMs and the compliance state is 'Not started'. What is the most likely reason?

Accepted Answer

The policy mode 'Indexed' requires a remediation task to be created; the policy only evaluates resources when a remediation task is triggered.. Option C is correct because the policy mode is 'Indexed', which only evaluates resource types that support tags and location; virtual machines are indexed, but the policy might not trigger if the assignment scope is not a management group or subscription. Option A is wrong because the parameter is required. Option B is wrong because the agent is not installed, but the policy should evaluate. Option D is wrong because built-in policies can be assigned.

Answer

The policy parameter 'workspaceId' is not provided during assignment.

Answer

Built-in policies cannot be assigned directly to a resource group; they must be assigned to a management group.

Answer

The Log Analytics agent is already installed on all VMs.

Question 10

Your organization is using Microsoft Sentinel to centralize security data from multiple sources. You need to ensure that data from Azure Active Directory (now Microsoft Entra ID) logs is ingested. Which two of the following should you configure? (Choose two.)

Accepted Answer

Configure diagnostic settings in Microsoft Entra ID to stream audit and sign-in logs to a Log Analytics workspace.. Option A and Option D are correct because Microsoft Entra ID logs are ingested via diagnostic settings, and the data connector in Sentinel is used to establish the connection. Option B is wrong because a Log Analytics workspace is required, not a separate one. Option C is wrong because the Log Analytics agent is for VMs, not for Entra ID logs. Option E is wrong because there is a specific connector for Entra ID.

Answer

Enable the Microsoft 365 Defender data connector in Sentinel.

Answer

Create a separate Log Analytics workspace for Microsoft Entra ID logs.

Answer

Install the Log Analytics agent on domain controllers.

Question 11

Your company is implementing Microsoft Defender for Cloud's Security Alerts. You need to ensure that alerts for critical severity are automatically sent to the security operations team via email and also create a ticket in ServiceNow. Which three actions should you take? (Choose three.)

Accepted Answer

Create a continuous export rule in Defender for Cloud to send alerts to an Event Hubs namespace.. Options A, C, and E are correct. Option A is correct because email notifications for critical alerts can be configured in Defender for Cloud. Option C is correct because a continuous export rule can send alerts to Event Hubs, which can trigger a Logic App. Option E is correct because a Logic App can integrate with ServiceNow. Option B is wrong because the Log Analytics agent is not needed for alerts. Option D is wrong because a playbook in Sentinel is not required; the integration can be done via Logic Apps directly.

Answer

Create a playbook in Microsoft Sentinel that triggers on alerts.

Answer

Install the Log Analytics agent on all VMs to collect security alerts.

Question 12

Your organization wants to use Microsoft Sentinel to detect and respond to threats. You need to ensure that Sentinel can ingest data from Azure Firewall logs. Which three components are required? (Choose three.)

Accepted Answer

Enable diagnostic logs on Azure Firewall.. Options A, D, and E are correct. Option A is correct because Azure Firewall must have diagnostic logs enabled. Option D is correct because a Log Analytics workspace is needed to store the logs. Option E is correct because the Azure Firewall data connector in Sentinel pulls the logs. Option B is wrong because the Log Analytics agent is not used for Azure Firewall; it uses diagnostic settings. Option C is wrong because Azure Policy is not required for ingestion.

Answer

Assign an Azure Policy to enforce diagnostic logs on all firewalls.

Answer

Install the Log Analytics agent on the Azure Firewall.

Question 13

Your company uses Microsoft Defender for Cloud to protect Azure resources. You want to enable the 'Defender for Containers' plan to secure AKS clusters. Which two configurations are necessary? (Choose two.)

Accepted Answer

Enable the 'Defender for Containers' plan in Microsoft Defender for Cloud.. Options A and D are correct. Option A is correct because the Defender for Containers plan must be enabled at the subscription level. Option D is correct because the Kubernetes audit logs must be enabled and sent to a Log Analytics workspace. Option B is wrong because Azure Policy is not required for the plan. Option C is wrong because the plan does not require a specific agent; it uses audit logs. Option E is wrong because Azure Arc is for non-Azure clusters.

Answer

Assign the 'Kubernetes cluster should be accessible only through private endpoint' Azure Policy.

Answer

Connect the AKS cluster to Azure Arc.

Answer

Install the Log Analytics agent on each AKS node.

Question 14

Your company is using Microsoft Sentinel for security operations. You need to create a threat intelligence (TI) feed that allows Sentinel to match indicators from an external source. Which three actions should you take? (Choose three.)

Accepted Answer

Upload threat intelligence indicators using the Threat Intelligence API or portal.. Options A, C, and D are correct. Option A is correct because TI indicators must be ingested into Sentinel's TI. Option C is correct because analytics rules can be configured to match TI. Option D is correct because the TI data connector is used for ingestion. Option B is wrong because watchlists are for reference data, not TI. Option E is wrong because Fusion rules are for correlation, not TI matching.

Answer

Create a watchlist containing the indicators.

Answer

Enable the Fusion rule to correlate TI indicators with other events.

Question 15

Your organization has a complex Azure environment with multiple subscriptions, each containing hundreds of VMs and PaaS services. You are responsible for ensuring that all resources are monitored for security threats using Microsoft Defender for Cloud. The environment includes: - Subscription A: Production workloads, requires the highest security posture. - Subscription B: Development environment, has a lower security budget. - Subscription C: Shared services (e.g., DNS, Active Directory). You need to implement the most cost-effective security monitoring solution that meets the following requirements: - All subscriptions must be covered by Defender for Cloud. - Production subscription must have vulnerability assessment for VMs. - Development subscription does not need vulnerability assessment but must have basic CSPM. - Shared services subscription must have advanced threat protection for Azure SQL databases. - You must minimize administrative overhead and ensure that security policies are centrally managed. What should you do?

Accepted Answer

Enable the 'Defender Cloud Security Posture Management' (CSPM) plan on the management group that contains all subscriptions. Then, on Subscription A, enable the 'Defender for Servers' plan with vulnerability assessment. On Subscription C, enable the 'Defender for Azure SQL' plan. Leave Subscription B with only the CSPM plan.. Option A is correct because enabling the Defender CSPM plan provides basic CSPM and allows enabling specific plans per subscription. Option B is wrong because enabling all plans on Subscription A is not cost-effective for Dev. Option C is wrong because using only free tier does not meet the vulnerability assessment requirement. Option D is wrong because disabling Defender for Cloud on Dev is not allowed; they need basic CSPM.

Answer

Enable all Defender plans on the management group to cover all subscriptions, then disable vulnerability assessment on Subscription B via policy.

Answer

Enable the 'Defender for Servers' plan on Subscription A, 'Defender for Azure SQL' on Subscription C, and disable Defender for Cloud on Subscription B.

Answer

Enable only the free tier of Defender for Cloud on all subscriptions, then manually configure vulnerability assessment for VMs in Subscription A and advanced threat protection for SQL in Subscription C.