AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 12 — 15 Questions

Question 1

Your company uses Microsoft Sentinel to monitor Azure resources. A new analytics rule is created to detect anomalous access to storage accounts. The rule runs every 5 minutes and looks at the last 15 minutes of data. After deploying, the rule generates no alerts even though you suspect there are anomalies. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The rule query logic is incorrect or the entities are not properly mapped.. The most likely issue is that the rule query logic is incorrect or the entities are not properly mapped. In Microsoft Sentinel, an analytics rule uses a KQL query to detect anomalies; if the query syntax is wrong, the logic fails to match the expected data patterns, or the entity mappings (e.g., Account, IP, Host) are misconfigured, the rule will not generate alerts even when anomalous activity exists. Without correct entity mapping, the rule cannot correlate events or trigger incidents, resulting in zero alerts despite underlying anomalies.

Answer

The rule is not enabled.

Answer

The rule severity is set too low.

Answer

The rule query frequency is longer than the data lookback period.

Question 2

Your organization wants to use Microsoft Sentinel to automatically respond to high-severity incidents. Which feature should you configure?

Accepted Answer

Create an automation rule that triggers a playbook on incident creation.. Microsoft Sentinel automation rules allow you to define automated responses to incidents, such as triggering a playbook (a collection of actions based on Azure Logic Apps) when an incident is created. This directly meets the requirement to automatically respond to high-severity incidents without manual intervention.

Answer

Create an analytics rule with a high severity.

Answer

Create a workbook to visualize incidents.

Answer

Enable entity behavior analytics.

Question 3

Which TWO of the following are valid methods to ingest data into Microsoft Sentinel? (Select two.)

Accepted Answer

Using the Log Analytics agent to send custom logs.. Option A is correct because the Log Analytics agent (MMA/AMA) can be installed on machines to collect custom logs and Windows/Linux events and forward them to the Log Analytics workspace that backs Microsoft Sentinel, including custom log ingestion via the Log Analytics Data Collector API or custom tables. Option E is correct because Microsoft Sentinel ingests data through data connectors, many of which are available from the Content Hub (e.g., Microsoft 365 Defender, Azure Activity, AWS, syslog via AMA), and these connectors are the primary supported ingestion method. Option B is not a valid ingestion method because Azure PowerShell cmdlets manage resources and configuration but do not stream event data directly into Sentinel; ingestion occurs via agents, connectors, or the Data Collector API. Option C is not valid because Power BI is a visualization and reporting tool, not a data streaming or ingestion pipeline into Sentinel. Option D is not valid because Azure Policy enforces governance and compliance on resources; it does not forward logs to Microsoft Sentinel, though diagnostic settings or connectors are used for that purpose.

Answer

Using the Azure PowerShell cmdlets to send events directly.

Answer

Using Power BI to stream data.

Answer

Using Azure Policy to forward logs.

Question 4

Which TWO of the following are valid data sources for Microsoft Sentinel's UEBA (User and Entity Behavior Analytics)? (Select two.)

Accepted Answer

Microsoft Entra ID sign-in logs.. Microsoft Sentinel UEBA is designed to ingest identity-centric telemetry, and Microsoft Entra ID sign-in logs (option A) are a core data source because they provide the authentication events (user, application, IP, location, device, risk level) that UEBA uses to build behavioral baselines and detect anomalous sign-in activity. Microsoft Entra ID audit logs (option B) are also a valid UEBA source, since they record directory-level changes such as user, group, role, and application modifications that feed entity behavior profiling and help correlate administrative actions with other activity. Options C, D, and E are not among the documented UEBA data sources: Azure SQL Database audit logs, Azure Activity Logs, and Azure Firewall logs are resource/network telemetry that can be collected into Sentinel for analytics, but they are not identity behavior sources used by the UEBA engine.

Answer

Azure SQL Database audit logs.

Answer

Azure Activity Logs.

Answer

Azure Firewall logs.

Question 5

Your organization uses Microsoft Defender for Cloud to protect Azure workloads. You notice that a critical Azure VM is not covered by any of the Defender for Cloud plans. You need to ensure that the VM is protected by the Defender for Servers plan. What should you do?

Accepted Answer

Enable the Defender for Servers plan in the Defender for Cloud environment settings for the subscription containing the VM.. Defender for Cloud plans are enabled at the subscription level, not per resource. By enabling the Defender for Servers plan in the Defender for Cloud environment settings for the subscription containing the VM, all current and future VMs in that subscription will be automatically protected, including the critical VM in question.

Answer

Create a custom Azure Policy to assign the Defender for Servers plan to the VM.

Answer

Enable the Defender for Servers plan directly on the VM's security configuration blade.

Answer

Ensure the VM is running a supported operating system; the plan is automatically enabled for all VMs.

Question 6

Your organization has multiple Azure subscriptions and uses Microsoft Defender for Cloud. You need to ensure that all subscriptions have a consistent security policy applied. You create a management group containing all subscriptions. What should you do next to assign a Defender for Cloud initiative to all subscriptions?

Accepted Answer

Assign the initiative as an Azure Policy at the management group scope.. Assigning the initiative as an Azure Policy at the management group scope is the correct approach because Azure Policy can be applied at the management group, subscription, or resource group level, and it will be inherited by all child subscriptions. This ensures a consistent security policy across all subscriptions without manual per-subscription configuration. Microsoft Defender for Cloud uses Azure Policy initiatives (such as the Microsoft Cloud Security Benchmark) to enforce security controls, and assigning at the management group scope is the most efficient method for bulk compliance.

Answer

Use Azure Blueprints to define the initiative and assign it to the management group.

Answer

Create a custom RBAC role that includes the initiative and assign it to the management group.

Answer

Assign the initiative to each subscription individually using the Defender for Cloud interface.

Question 7

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). You need to investigate a possible insider threat where a user is accessing sensitive data from unusual locations. Which Sentinel feature should you use to visualize the user's activities and related entities?

Accepted Answer

UEBA investigation insights and entity pages. UEBA in Microsoft Sentinel provides investigation insights and entity pages that aggregate user activities, related entities, and behavioral anomalies into a visual timeline. This allows you to see a user's access patterns from unusual locations and correlate them with other entities like devices or IP addresses, making it the correct feature for investigating insider threats.

Answer

Hunting queries

Answer

Analytics rules

Answer

Workbooks

Question 8

You are configuring Microsoft Defender for Cloud's regulatory compliance dashboard. Your organization must comply with SOC 2. You have enabled the SOC 2 regulatory compliance standard. After a week, some controls show as 'Unhealthy'. What is the most likely reason for the 'Unhealthy' status?

Accepted Answer

The underlying Azure Policy initiatives have resources that are non-compliant.. The 'Unhealthy' status in Defender for Cloud's regulatory compliance dashboard indicates that the underlying Azure Policy initiatives associated with the SOC 2 standard have identified resources that are non-compliant. Defender for Cloud maps regulatory standards to Azure Policy definitions, and the compliance score is derived from the compliance state of those policies. Therefore, when controls show as 'Unhealthy', it is because the corresponding Azure Policy evaluations have found resources that do not meet the required configuration or security controls defined by SOC 2.

Answer

The standard is not fully enabled for all subscriptions.

Answer

The SOC 2 standard is not supported by Defender for Cloud.

Answer

You need to manually attest to the controls to mark them as healthy.

Question 9

Refer to the exhibit. You are creating a Microsoft Sentinel scheduled analytics rule using the KQL query shown. The rule is set to run every hour. What will this rule detect?

Accepted Answer

Accounts that have more than 10 failed logins from a specific IP address in the last hour. The KQL query uses `summarize` with `bin(TimeGenerated, 1h)` to count failed logins per account and IP address within 1-hour bins. The `where` clause filters for `ResultType == 50057` (failed logins) and `where count_ > 10` ensures only accounts with more than 10 failed logins from a specific IP in that hour are returned. Since the rule runs every hour, it detects accounts exceeding 10 failed logins from a single IP in the last hour.

Answer

Successful logins from a single IP address

Answer

Total failed logins in the last 24 hours

Answer

Accounts with more than 10 failed logins from any IP address

Question 10

Which TWO are benefits of using Microsoft Sentinel's automation rules? (Choose two.)

Accepted Answer

Trigger a playbook when an incident is created or updated.. Option D is correct because Microsoft Sentinel automation rules can define conditions (such as incident creation or update) and then invoke a playbook (Logic App) as the action, enabling automated response workflows. Option E is correct because automation rules support an 'Assign owner' action, letting you automatically route incidents to a specific analyst or team based on rule conditions. Options A, B, and C are not benefits of automation rules: incident aggregation/merging is handled by the incident merging feature rather than automation rules, analytics rules are created manually or via templates/API rather than generated from incident patterns by automation rules, and querying external threat intelligence feeds is performed through threat intelligence connectors, watchlists, or analytics rule queries, not automation rules.

Answer

Aggregate multiple incidents into a single incident.

Answer

Create new analytics rules based on incident patterns.

Answer

Automatically query external threat intelligence feeds.

Question 11

Which TWO are capabilities of Microsoft Sentinel UEBA? (Choose two.)

Accepted Answer

Entity pages with timelines and related events. Option B is correct because Microsoft Sentinel UEBA provides entity pages that show a timeline of activities and related events for entities such as users, hosts, and IP addresses, helping analysts investigate anomalous behavior in context. Option D is correct because UEBA includes peer group analysis, which baselines an entity's behavior against similar peers to surface deviations that may indicate compromise or insider threat. Option A is not a UEBA capability per se; threat intelligence integration is a separate Sentinel feature (threat intelligence connectors and analytics rules), not part of UEBA's behavioral analytics. Option C is incorrect because UEBA does not automatically create incidents for every detected anomaly; anomalies are surfaced as insights/entities and can be used by analytics rules to generate incidents selectively. Option E is incorrect because automated response actions such as blocking IPs are handled by Sentinel automation rules and playbooks (Logic Apps), not by the UEBA feature itself.

Answer

Integration with external threat intelligence feeds

Answer

Automatic incident creation for all detected anomalies

Answer

Automated response actions like blocking IPs

Question 12

Which THREE are prerequisites for integrating Microsoft Sentinel with Microsoft Defender XDR? (Choose three.)

Accepted Answer

Appropriate permissions (Security Administrator or Global Administrator). Integrating Microsoft Sentinel with Microsoft Defender XDR requires the user to have either Security Administrator or Global Administrator roles in Microsoft Entra ID. These permissions are necessary to grant consent for the data connector and to configure cross-tenant or cross-service access policies that enable Defender XDR to send incident and alert data to Sentinel.

Answer

The Microsoft Monitoring Agent installed on all endpoints

Answer

An Azure Sentinel workspace in the same region as the Microsoft 365 tenant

Question 13

Refer to the exhibit. You are reviewing the encryption configuration of an Azure Log Analytics workspace used by Microsoft Sentinel. The configuration shows infrastructure encryption enabled and customer-managed key (CMK) from Azure Key Vault. What additional step must be taken to ensure that the CMK is used for all data?

Accepted Answer

Grant the Log Analytics workspace access to the Key Vault key. When you configure a customer-managed key (CMK) for a Log Analytics workspace, you must explicitly grant the workspace (via its managed identity) the 'Get', 'Unwrap Key', and 'Wrap Key' permissions on the Key Vault key. Without this access, the workspace cannot use the CMK to encrypt data at rest. Option C correctly identifies this required step.

Answer

Enable double encryption on Sentinel

Answer

Enable purge protection on the Key Vault

Answer

Ensure the Key Vault is in a different region than the workspace

Question 14

You are responsible for securing an Azure environment using Microsoft Defender for Cloud. You need to reduce the number of false positive security alerts for a specific Azure SQL Database. The database is regularly scanned by a legitimate security tool that generates alerts. What should you do?

Accepted Answer

Create a suppression rule for the specific alert type and source IP address.. Microsoft Defender for Cloud allows you to create suppression rules to automatically filter out specific security alerts that are known to be benign. By configuring a suppression rule for the specific alert type and the source IP address of the legitimate security scanning tool, you can prevent those alerts from appearing in the security alerts queue without disabling broader detection for SQL databases. This approach reduces false positives while maintaining visibility into other potential threats.

Answer

Disable the security alert rule for SQL databases in Defender for Cloud.

Answer

Exclude the database from the vulnerability assessment solution.

Answer

Modify the Azure SQL Database firewall rules to allow the scanning tool's IP.

Question 15

You need to enable Microsoft Defender for Cloud's workload protection for Azure Kubernetes Service (AKS) clusters. Which Defender plan should you enable?

Accepted Answer

Enable Defender for Containers.. To enable workload protection for Azure Kubernetes Service (AKS) clusters in Microsoft Defender for Cloud, you must enable the Defender for Containers plan. This plan provides runtime threat detection, vulnerability assessment, and compliance monitoring specifically for containerized environments, including AKS, Azure Container Registry (ACR), and Azure Container Instances (ACI). It covers Kubernetes audit logs, host-level security, and container image scanning, which are essential for securing AKS workloads.

Answer

Enable the foundational Cloud Security Posture Management (CSPM) plan.

Answer

Enable Defender for SQL.

Answer

Enable Defender for Servers.