AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 13 — 15 Questions

Question 1

Your company has a Microsoft Sentinel workspace that ingests logs from multiple sources, including Azure Active Directory (now Microsoft Entra ID), Azure Firewall, and Microsoft 365 Defender. You are asked to create an analytics rule that detects when a user account is deleted from Microsoft Entra ID and then, within 24 hours, a large number of Azure resources are deleted in the same tenant. You have the following requirements: - The rule must use KQL to correlate events across two tables: AuditLogs (for user deletion) and ActivityLogs (for resource deletion). - The rule should trigger an incident only if more than 10 resources are deleted within 24 hours after the user deletion. - The incident severity should be set to 'High'. - The rule should run every hour and look back 24 hours. Which of the following is the correct KQL query for the analytics rule? (Choose the best option.)

Accepted Answer

let deletionTime = AuditLogs | where OperationName == 'Delete user' | project DeletionTime = TimeGenerated, UserPrincipalName; deletionTime | join kind=inner (ActivityLogs | where OperationName == 'Delete resource') on UserPrincipalName | where ActivityLogs_TimeGenerated between (DeletionTime .. DeletionTime + 24h) | summarize ResourceCount = count() by UserPrincipalName | where ResourceCount > 10. Option B is correct because it uses 'let' to define the user deletion time, then joins with ActivityLogs to count resource deletions within 24 hours. Option A is wrong because it does not filter for resource deletion operations. Option C is wrong because it uses 'summarize' incorrectly. Option D is wrong because it does not handle the time window correctly.

Answer

Answer

AuditLogs | where OperationName == 'Delete user' | join kind=inner (ActivityLogs) on $left.Caller == $right.Caller | where TimeGenerated < ActivityLogs_TimeGenerated and TimeGenerated + 24h > ActivityLogs_TimeGenerated | summarize ResourceCount = count() by UserPrincipalName | where ResourceCount > 10

Answer

Question 2

Your company uses Microsoft Defender for Cloud's regulatory compliance dashboard to track compliance with the PCI DSS standard. You have enabled the PCI DSS initiative on the management group. The dashboard shows that some controls are 'Not started' even though you have implemented the required security configurations. You suspect that the assessment might not be running correctly. You need to ensure that the compliance assessments are triggered for all resources. The environment consists of: - 3 subscriptions under a management group. - All subscriptions have Defender for Cloud enabled with the CSPM plan. - The PCI DSS initiative was assigned at the management group level. - Some resources are in regions that do not support certain policy effects. What is the most likely reason for the 'Not started' status?

Accepted Answer

Some policies in the PCI DSS initiative use effects that are not supported in certain regions, causing the assessment to not run.. Option C is correct because the built-in PCI DSS initiative includes policies that may have effects not supported in all regions, causing assessment failures. Option A is wrong because the CSPM plan is already enabled. Option B is wrong because the initiative at management group should assess all subscriptions. Option D is wrong because the compliance dashboard uses assessments from policies, not manual checks.

Answer

The compliance dashboard only displays results if you manually run an assessment.

Answer

The PCI DSS initiative must be assigned to each subscription individually.

Answer

The Defender Cloud Security Posture Management (CSPM) plan is not enabled on all subscriptions.

Question 3

Your organization uses Microsoft Sentinel to monitor for data exfiltration. You have configured a scheduled analytics rule that detects when an external IP address downloads more than 100 MB of data from an Azure Storage account within 5 minutes. The rule triggers, but the incident created has a severity of 'Low', while your team wants it to be 'High' for all such incidents. What should you do?

Accepted Answer

Edit the analytics rule and change the 'Severity' setting to 'High' in the 'Incident settings' tab.. Option A is correct because you can set the severity in the analytics rule wizard under 'Incident settings'. Option B is wrong because incident severity is set in the rule, not in the playbook. Option C is wrong because automation rules can change severity but only after incident creation; it's better to set it in the rule. Option D is wrong because the entity mapping does not affect severity.

Answer

Create a playbook that changes the severity of incidents created by that rule and attach it via an automation rule.

Answer

Add an entity mapping for the storage account so that the severity is inherited from the entity.

Answer

Create an automation rule that triggers on incident creation and sets the severity to 'High' for all incidents from that rule.

Question 4

Your company has a Microsoft Sentinel workspace that ingests logs from Azure AD, Azure Activity, and Azure Firewall. You are investigating an incident where an attacker gained access to a user's credentials and logged in from an unusual location. The sign-in log shows that the user passed MFA. You suspect that the attacker might have used a phishing attack to bypass MFA. Which Microsoft 365 Defender feature should you enable to detect such attacks?

Accepted Answer

Microsoft 365 Defender's Attack simulation training.. Option D is correct because 'Attack simulation training' in Microsoft 365 Defender allows you to simulate phishing attacks and identify users who are vulnerable. Option A is wrong because 'Conditional Access policies' are for enforcing MFA, not detecting phishing. Option B is wrong because 'Identity Protection' detects risky sign-ins but does not simulate attacks. Option C is wrong because 'Microsoft Defender for Office 365' includes anti-phishing but not simulation.

Answer

Microsoft Defender for Office 365's anti-phishing policies.

Answer

Microsoft Entra Conditional Access policies with session control.

Answer

Microsoft Entra Identity Protection with user risk policy.

Question 5

Your organization uses Microsoft Defender for Cloud with the CSPM plan enabled. You need to ensure that all Azure subscriptions have Microsoft Defender for Cloud's auto-provisioning enabled for the Log Analytics agent. Which Azure Policy initiative should you assign?

Accepted Answer

Deploy Log Analytics agent for Microsoft Defender for Cloud. The Azure Policy initiative 'Deploy Log Analytics agent for Microsoft Defender for Cloud' includes policies to auto-provision the Log Analytics agent on VMs. Option B is correct. Option A is a built-in initiative for general security configuration, not specifically for auto-provisioning. Option C is for regulatory compliance. Option D is for Azure Backup.

Answer

Configure backup on virtual machines

Answer

CIS Microsoft Azure Foundations Benchmark

Answer

Azure Security Benchmark

Question 6

You have configured Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). You notice that sign-in logs for external guest users are not appearing in Sentinel. What is the most likely cause?

Accepted Answer

The diagnostic settings in Microsoft Entra ID are not configured to stream sign-in logs to the Log Analytics workspace used by Sentinel.. Sentinel ingestion of Entra ID logs requires diagnostic settings to be configured on the Entra ID tenant. By default, diagnostic settings are not enabled for external guest user sign-ins. Option C is correct. Option A is not a requirement. Option B is incorrect because guest user sign-ins are logged but need diagnostic settings. Option D is incorrect because the connector does not filter by user type.

Answer

Microsoft Sentinel does not support ingestion of external guest user sign-in logs.

Answer

The Microsoft Sentinel Entra ID connector requires a separate connector for guest users.

Answer

Guest user sign-ins are not logged in Microsoft Entra ID.

Question 7

Your security team wants to use Microsoft Defender for Cloud's 'Just-In-Time (JIT) VM access' to reduce the attack surface. Which Azure policy must be enabled on the subscription to use JIT?

Accepted Answer

Microsoft Defender for Servers. JIT VM access is a feature of Microsoft Defender for Cloud's Cloud Workload Protection Platform (CWPP) and requires the 'Servers' plan to be enabled. Option A is correct. Option B is for databases. Option C is for storage. Option D is for Key Vault.

Answer

Microsoft Defender for Databases

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Key Vault

Question 8

Which TWO actions can you perform using Microsoft Sentinel's UEBA (User and Entity Behavior Analytics) feature? (Choose two.)

Accepted Answer

Detect anomalous behavior based on historical user activity. UEBA in Sentinel provides anomaly detection and peer comparison. Option A (anomaly detection) and Option D (peer anomaly scoring) are correct. Option B is a feature of Defender for Cloud Apps, not Sentinel UEBA. Option C is not a UEBA feature. Option E is for hunting, not UEBA.

Answer

Block sign-ins from anonymous IP addresses

Answer

Run KQL queries to find threats across multiple data sources

Answer

Automatically disable compromised user accounts

Question 9

Which THREE Microsoft Defender for Cloud features require Microsoft Defender for Servers Plan 2? (Choose three.)

Accepted Answer

File Integrity Monitoring (FIM). Plan 2 includes adaptive application controls, file integrity monitoring, and adaptive network hardening. Option A (JIT VM access) is available in Plan 1. Option B (adaptive application controls) requires Plan 2. Option C (file integrity monitoring) requires Plan 2. Option D (adaptive network hardening) requires Plan 2. Option E (vulnerability assessment) is available in Plan 1.

Answer

Just-In-Time VM access

Answer

Integrated vulnerability assessment (Qualys)

Question 10

Which TWO data sources can be connected to Microsoft Sentinel using built-in data connectors? (Choose two.)

Accepted Answer

Microsoft 365 Defender incidents. Sentinel has built-in connectors for Azure Active Directory (Entra ID) and Microsoft 365 Defender. Option A and B are correct. Option C (AWS CloudTrail) requires a connector via AWS but is not built-in (requires AWS S3). Option D (MySQL audit logs) is not a built-in connector. Option E (On-premises Windows Firewall) requires a Log Analytics agent or AMA, not a built-in connector.

Answer

Amazon Web Services (AWS) CloudTrail

Answer

MySQL audit logs

Answer

On-premises Windows Firewall logs

Question 11

What is the primary purpose of this KQL query?

Accepted Answer

Identify the most common alert types by severity over the last week. The query summarizes alerts by AlertName and Severity and orders by count, which helps identify the most common alerts. Option B is correct. Option A is wrong because it does not analyze trends over time. Option C is wrong because it does not correlate with incidents. Option D is wrong because it does not check for false positives.

Answer

Check for alerts that have been automatically resolved

Answer

Identify alerts with high false positive rates over the last 7 days

Answer

Correlate alerts with Microsoft Defender for Cloud incidents

Question 12

You are a security engineer for Contoso Ltd. The company has a hybrid environment with Azure VMs and on-premises servers running Windows Server 2022. You have enabled Microsoft Defender for Cloud's multi-cloud posture management for AWS and GCP. Recently, you deployed Microsoft Sentinel in a Log Analytics workspace named 'ContosoWorkspace'. The security team needs to centralize security alerts from all sources: Azure, on-premises, AWS, and GCP. They also require automated investigation and response for common threats. Specifically, they want to automatically disable a compromised user account when a high-severity alert is generated. You have configured data connectors for Azure Activity, Microsoft Entra ID, and AWS CloudTrail. For on-premises servers, you installed the Azure Monitor Agent (AMA) and enabled Defender for Cloud's plan for servers. For GCP, you are using the GCP Security Command Center connector. The team needs to create a playbook that runs when a high-severity alert from any source is triggered. The playbook should disable the user account in Microsoft Entra ID. You have created a playbook using Azure Logic Apps and granted it the necessary permissions. Which step should you take to ensure the playbook runs automatically when alerts are generated?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers the playbook when a high-severity alert is created.. To run a playbook automatically in response to alerts, you need to create an automation rule in Microsoft Sentinel that triggers the playbook when an alert is generated. Option B is correct. Option A is incorrect because analytics rules are for generating alerts, not for response. Option C is incorrect because playbooks are not created in Defender for Cloud. Option D is incorrect because the Logic App itself does not trigger on alerts without an automation rule.

Answer

Create an automation rule in Microsoft Defender for Cloud that triggers the playbook when a high-severity alert is generated.

Answer

Create an analytics rule in Microsoft Sentinel that triggers the playbook when a high-severity alert is created.

Answer

Configure the Logic App to run on a schedule and query Sentinel for high-severity alerts.

Question 13

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. The security team wants to implement a continuous compliance monitoring solution using Microsoft Defender for Cloud's regulatory compliance dashboard. They need to monitor compliance against the 'CIS Microsoft Azure Foundations Benchmark' and 'PCI DSS v3.2.1'. Currently, the subscription has the 'Azure Security Benchmark' initiative assigned. You need to configure the compliance dashboard to show both CIS and PCI DSS standards. The subscription already has Microsoft Defender for Cloud's CSPM plan enabled. You have also enabled the 'Defender for Cloud' plan for servers. What should you do to meet the requirements?

Accepted Answer

Add the CIS Microsoft Azure Foundations Benchmark and PCI DSS v3.2.1 policy initiatives to the regulatory compliance dashboard.. To add compliance standards to the regulatory compliance dashboard, you need to add the corresponding policy initiatives. Option D is correct. Option A is incorrect because you do not need to remove existing initiatives. Option B is incorrect because the CIS benchmark is not automatically enabled; you must add it. Option C is incorrect because you need to add the initiatives, not just enable Defender plans.

Answer

Enable the CIS benchmark in the Microsoft Defender for Cloud settings.

Answer

Enable Microsoft Defender for Cloud's regulatory compliance add-on.

Answer

Remove the Azure Security Benchmark initiative and assign the CIS and PCI DSS initiatives.

Question 14

You are a security analyst at Fabrikam Inc. You have deployed Microsoft Sentinel and connected it to Microsoft 365 Defender (formerly Microsoft Threat Protection). You have also enabled UEBA and set up analytics rules for detecting suspicious sign-ins. Recently, you noticed that some high-severity incidents from Microsoft 365 Defender are not appearing in Microsoft Sentinel. You have verified that the Microsoft 365 Defender connector is enabled and that incidents are being sent to the workspace. However, the incidents are not being created as Sentinel incidents. What is the most likely reason?

Accepted Answer

The 'Microsoft 365 Defender' incident creation rule in Microsoft Sentinel is disabled.. By default, Microsoft Sentinel can create incidents from Microsoft 365 Defender incidents, but the incident creation rule must be enabled. Option A is correct. Option B is incorrect because the connector does not need to be premium. Option C is incorrect because you can create incidents from M365 Defender incidents. Option D is incorrect because the analytics rule is for generating alerts, not for ingesting incidents.

Answer

The analytics rule for sign-in detection is conflicting with the Microsoft 365 Defender connector.

Answer

The Microsoft 365 Defender connector requires a premium license.

Answer

Microsoft Sentinel cannot create incidents from Microsoft 365 Defender incidents; only alerts can be ingested.

Question 15

Your company uses Microsoft Defender for Cloud's 'Vulnerability Assessment' solution for Azure VMs. You have enabled the 'Microsoft Defender for Servers' plan and deployed the integrated Qualys agent. You need to view the vulnerability assessment findings for all VMs in a single dashboard in Microsoft Defender for Cloud. Which blade in the Defender for Cloud portal should you navigate to?

Accepted Answer

Recommendations. The 'Security alerts' blade shows security alerts, not vulnerability findings. The 'Recommendations' blade includes vulnerability assessment findings. Option B is correct. Option A is for alerts. Option C is for inventory. Option D is for regulatory compliance.

Answer

Inventory

Answer

Security alerts

Answer

Regulatory compliance