AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 13 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel for security operations. You need to create a custom analytics rule that triggers an incident when a user executes a suspicious PowerShell command on a Windows server. The logs are stored in the 'DeviceEvents' table from Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). The rule should run every 5 minutes. Which scheduling frequency and query period should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run query every 5 minutes with a query period of 5 minutes. For a custom analytics rule in Microsoft Sentinel, the query period should be set equal to or less than the scheduling frequency to ensure complete coverage and avoid duplication or gaps. Since the rule must run every 5 minutes, a query period of 5 minutes (Option C) is appropriate—it aligns with the frequency and captures all events within each interval. Option A uses a 10-minute frequency, which does not meet the 5-minute requirement. Option B uses a 1-minute period, which may miss events that occur between runs. Option D uses a 10-minute period with a 5-minute frequency, causing overlapping results and potential duplication. Therefore, Option C is correct.

Answer

Run query every 10 minutes with a query period of 5 minutes

Answer

Run query every 5 minutes with a query period of 1 minute

Answer

Run query every 5 minutes with a query period of 10 minutes

Question 2

You are a security engineer for a large enterprise using Microsoft Sentinel. You have multiple workspaces deployed across different Azure regions to meet data residency requirements. You need to query data across all workspaces from a single query. You have set up a workspace as the 'central' workspace for cross-workspace queries. The central workspace has the necessary permissions to access the other workspaces. Which KQL operator should you use to include data from other workspaces in your query?

Accepted Answer

union. The 'union' operator is used to combine data from multiple tables or workspace expressions. For cross-workspace queries in Microsoft Sentinel, you use the 'union' operator with a workspace() expression to include data from other workspaces. Option A (where) filters rows, option C (join) merges tables based on a key, and option D (project) selects columns. Therefore, option B (union) is correct.

Answer

where

Answer

join

Answer

project

Question 3

You are the security engineer for a multinational company that uses Azure to host critical workloads. The company has deployed Microsoft Defender for Cloud with the enhanced security features enabled on all subscriptions. Recently, a security audit revealed that several virtual machines (VMs) in the production environment are missing critical security updates. The audit report indicates that the VMs are not being assessed for missing updates by Defender for Cloud. You need to ensure that all VMs are automatically assessed for missing OS updates using Defender for Cloud's vulnerability assessment capabilities. The solution must minimize administrative overhead and should not require manual installation of agents on existing VMs. What should you do?

Accepted Answer

Enable the 'Servers' plan in Defender for Cloud and ensure that the 'Vulnerability assessment for machines' setting is turned on.

Answer

Enable the 'SQL servers on machines' plan in Defender for Cloud.

Answer

Configure a vulnerability assessment solution from the Azure Marketplace and assign it to the VMs.

Answer

Deploy the Log Analytics agent to all VMs using Azure Policy.

Question 4

Your organization uses Microsoft Sentinel for security operations. You need to create a custom analytics rule that triggers an incident when a user executes a suspicious PowerShell command on a Windows server. The logs are stored in the 'DeviceEvents' table from Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). The rule should run every 5 minutes. Which scheduling frequency and query period should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated <= 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated > 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=leftouter (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated > 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].displayName == $right.TargetResources[0].displayName | where TimeGenerated <= 24h

Question 5

Your company has deployed Microsoft Defender for Cloud in all subscriptions. You need to ensure that all Azure SQL databases are protected by Advanced Threat Protection (ATP). You want to enable ATP at the subscription level so that new databases are automatically protected. The security policy must be enforced to prevent administrators from disabling ATP on individual databases. What should you do?

Accepted Answer

Create a custom Azure Policy with a 'Deny' effect that prevents setting the Advanced Threat Protection setting to 'Disabled' on SQL databases.. It uses a custom Azure Policy with a 'Deny' effect to enforce that Advanced Threat Protection (ATP) cannot be disabled on any SQL database, including new ones. This approach ensures that the security policy is enforced at the subscription level, preventing administrators from turning off ATP on individual databases, which aligns with the requirement for automatic protection and enforcement.

Answer

Create an Azure Policy assignment using the built-in policy 'Advanced Threat Protection should be enabled on your SQL servers' with a 'Deny' effect.

Answer

Enable the 'Azure SQL databases' plan in Defender for Cloud at the subscription level.

Answer

Create an Azure Policy assignment that audits if Advanced Threat Protection is enabled on SQL databases, and remediate non-compliant resources.

Question 6

You are configuring Microsoft Defender for Cloud to protect an Azure Kubernetes Service (AKS) cluster. The cluster runs sensitive workloads. You need to enable threat detection and vulnerability assessment for the AKS environment. Which THREE of the following should you enable?

Accepted Answer

Microsoft Defender for Containers plan. Microsoft Defender for Containers plan is the correct choice because it provides threat detection and vulnerability assessment specifically for AKS clusters, including runtime threat protection for Kubernetes nodes and containers. This plan integrates with Defender for Cloud to monitor control plane and container workloads, enabling detection of suspicious activities like privilege escalations or crypto-mining. It is the dedicated plan for securing containerized environments, unlike the Servers plan which targets virtual machines.

Answer

Microsoft Defender for Servers plan

Answer

Azure Policy add-on for AKS

Question 7

A security operations team uses Microsoft Sentinel to monitor sign-in logs. They receive frequent false positive alerts for 'Anonymous IP address sign-in' from a specific external IP range used by a trusted partner. The analysts want to suppress these alerts without reducing detection coverage. What is the most efficient approach?

Accepted Answer

Create an alert suppression rule for the specific IP range in the analytics rule. Creating an alert suppression rule in Microsoft Sentinel allows analysts to suppress alerts from specific IP ranges without modifying the underlying analytics rule. Option A is wrong because disabling the analytics rule removes detection entirely. Option B is wrong because watchlists are used for correlation, not suppression. Option D is wrong because automation rules can run actions but not suppress alerts directly; suppression is a built-in feature of analytics rules.

Answer

Add the trusted IP range to a watchlist and reference it in the analytics rule query

Answer

Use an automation rule to close the incidents automatically

Answer

Disable the analytics rule that generates the alert

Question 8

A company is deploying Microsoft Sentinel in a new Azure subscription. The security team wants to ingest Windows security events from on-premises servers. Which data connector should they use?

Accepted Answer

Windows Security Events via AMA (Azure Monitor Agent). The Windows Security Events via AMA connector is the current recommended method for streaming Windows security events to Azure Sentinel using the Azure Monitor Agent. Option B is wrong because the Azure Active Directory connector is for Microsoft Entra ID logs, not Windows events. Option C is wrong because the Office 365 connector is for Office logs. Option D is wrong because the Common Event Format (CEF) connector is for syslog from security appliances, not Windows security events.

Answer

Office 365 connector

Answer

Azure Active Directory connector

Answer

Common Event Format (CEF) connector

Question 9

Your organization has enabled Microsoft Defender for Cloud on all subscriptions. You need to ensure that the security score is improved by implementing recommendations. Which TWO actions would directly improve the secure score?

Accepted Answer

Remediate a high-severity recommendation for a SQL database. Options C and E are correct because they directly impact the secure score. Remediating a high-severity recommendation (C) immediately improves the score by addressing a security weakness. Enabling automatic provisioning of the Log Analytics agent (E) is itself a recommendation that, when implemented, contributes to the secure score by ensuring necessary security monitoring is in place. Option A is incorrect because enabling Just-In-Time VM access, while a security control, is not always a scored recommendation and does not directly improve the score unless it is a specific recommendation that is remediated. Option B is incorrect because configuring email notifications for high-severity alerts does not affect the secure score; it only affects alerting. Option D is incorrect because assigning a custom Azure Policy initiative does not directly improve the score; the score improves only when resources become compliant with the policies, which is a separate action.

Answer

Enable Just-In-Time VM access on all virtual machines

Answer

Configure email notifications for high-severity alerts

Answer

Assign a custom Azure Policy initiative

Question 10

A SOC team uses Microsoft Sentinel. They want to create an analytics rule that detects excessive failed logons from a single IP address. The rule must run every 5 minutes and look back 1 hour. Which THREE components are required to configure this scheduled query rule?

Accepted Answer

Kusto Query Language (KQL) query. To configure a scheduled query rule in Microsoft Sentinel, three required components are: a Kusto Query Language (KQL) query (B) that defines the detection logic, an alert threshold (C) that specifies the number of results that trigger an alert (e.g., 'Generate alert based on number of results'), and incident configuration (D) that determines how alerts are grouped into incidents. Option A (Fusion rule) is incorrect because it is a different type of analytics rule, not a component. Option E (Playbook) is incorrect because playbooks are optional automated responses, not a required component.

Answer

Fusion rule

Answer

Playbook

Question 11

Refer to the exhibit. You are assigned a policy that deploys the Log Analytics agent to Linux VMs. After assigning this policy to a subscription, you notice that existing Linux VMs are not getting the agent deployed, but newly created VMs receive the agent. What is the most likely reason?

Accepted Answer

The policy assignment requires a remediation task to be created for existing non-compliant VMs. The policy uses 'deployIfNotExists' effect, which requires remediation tasks to be triggered on existing resources; the policy assignment does not automatically remediate existing VMs. Option B is wrong because the policy evaluates all VMs regardless of region. Option C is wrong because the policy does not require a managed identity for deployment; the 'deployIfNotExists' effect uses the system-assigned identity. Option D is wrong because the workspace ID is a required parameter, and if not provided, the assignment would fail.

Answer

The policy only applies to VMs in specific regions

Answer

The workspace ID parameter was not specified during assignment

Answer

The policy requires a managed identity to deploy the extension

Question 12

A company uses Microsoft Sentinel to centralize security logs. They need to ensure that incidents from Microsoft Defender XDR are synchronized into Sentinel. Which data connector should they enable?

Accepted Answer

Microsoft Defender XDR connector. The Microsoft Defender XDR connector ingests incidents and alerts from Defender XDR into Microsoft Sentinel. Option A is wrong because the Office 365 connector is for Office logs, not Defender XDR. Option B is wrong because the Windows Security Events connector ingests Windows event logs, not Defender XDR incidents. Option D is wrong because the Azure Activity connector ingests Azure resource logs, not Defender XDR incidents.

Answer

Office 365 connector

Answer

Windows Security Events connector

Answer

Azure Activity connector

Question 13

A company uses Microsoft Defender for Cloud to protect Azure resources. The security team wants to automatically remediate certain recommendations without manual intervention. They decide to use Azure Policy to enforce secure configurations. Which feature in Defender for Cloud allows them to create policy assignments directly from the recommendation?

Accepted Answer

Enforce. The 'Enforce' button on a recommendation allows creating a policy assignment that enforces the recommendation via Azure Policy. Option A is wrong because 'Quick fix' remediates a single resource, not enforces policy. Option B is wrong because 'Assign policy' button directly does this; 'View policy definition' only shows the definition. Option D is wrong because 'Remediate' triggers a remediation task on existing resources, not enforcing policy on new resources.

Answer

Remediate

Answer

View policy definition

Answer

Quick fix

Question 14

Your company uses Microsoft Sentinel to correlate data from multiple sources. You need to create an analytics rule that triggers an incident when a user signs in from an unfamiliar location and then performs a high-risk action in Azure. What is the best approach?

Accepted Answer

Create a Fusion analytics rule. The Fusion analytics rule is designed to correlate alerts from multiple Microsoft security products (e.g., Microsoft Defender for Identity, Microsoft Defender for Cloud Apps) to detect multi-stage attacks. In this scenario, the rule automatically matches a sign-in from an unfamiliar location (detected by Microsoft Defender for Identity) with a subsequent high-risk action in Azure (detected by Microsoft Defender for Cloud Apps) to create a single incident, reducing alert fatigue and providing context.

Answer

Run a custom anomaly detection job

Answer

Create a Scheduled analytics rule with a KQL query

Answer

Create a Near-Real-Time (NRT) analytics rule

Question 15

Refer to the exhibit. This is an excerpt from an Azure Policy assignment. What is the effect of the 'notScopes' property?

Accepted Answer

The policy will apply to all resources in RG-Prod except the VM-Sensitive virtual machine.. 'notScopes' excludes specific sub-scopes from the policy assignment. In this case, the policy applies to all resources in 'RG-Prod' except the VM named 'VM-Sensitive'. Option A is wrong because 'notScopes' do not add resources. Option B is wrong because it does not remove the entire resource group. Option D is wrong because it does not affect subscription-level exclusions.

Answer

The policy will apply only to the VM-Sensitive virtual machine.

Answer

The policy will apply to all resources in RG-Prod except the entire resource group.

Answer

The policy will apply to the subscription but not to RG-Prod.