AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 13 — 15 Questions

Question 1

You are configuring Microsoft Sentinel data connectors. Which data connector should you use to ingest logs from Microsoft Entra ID (Azure AD) audit logs and sign-in logs?

Accepted Answer

Microsoft Entra ID connector. The Microsoft Entra ID connector (formerly Azure AD connector) is specifically designed to ingest both audit logs and sign-in logs from Microsoft Entra ID into Microsoft Sentinel. This connector uses the Microsoft Graph API to pull the data, enabling security monitoring of identity-related activities such as user sign-ins, directory changes, and risky sign-in events. The other connectors either focus on different data sources or do not capture the full set of Entra ID logs.

Answer

Office 365 connector

Answer

Microsoft Defender XDR connector

Answer

Azure Activity connector

Question 2

Which TWO actions can you perform using Microsoft Defender for Cloud's regulatory compliance dashboard? (Select two.)

Accepted Answer

View the compliance status for built-in standards like SOC 2 or PCI DSS.. The regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of compliance status against built-in standards such as SOC 2, PCI DSS, ISO 27001, and Azure CIS. This dashboard aggregates security assessments and displays pass/fail status for each control, allowing you to track your compliance posture without manual configuration.

Answer

Create custom regulatory compliance recommendations.

Answer

Automatically remediate non-compliant resources.

Answer

Enable or disable Microsoft Defender plans for a subscription.

Question 3

Which THREE are valid methods to ingest data into Microsoft Sentinel? (Select three.)

Accepted Answer

Microsoft Sentinel Data Collector API. The Microsoft Sentinel Data Collector API is a valid ingestion method because it allows custom logs and data sources to be sent directly to Sentinel via a RESTful API endpoint. This is commonly used for non-standard data sources that do not have built-in connectors, enabling organizations to ingest data from custom applications or legacy systems.

Answer

Azure CLI

Answer

Azure Data Factory

Question 4

Which TWO are features of Microsoft Defender for Cloud's workload protection for Azure SQL databases? (Select two.)

Accepted Answer

Advanced threat protection (ATP). Option D (Advanced threat protection/ATP) is correct because Microsoft Defender for Cloud's workload protection for Azure SQL databases includes Defender for SQL's advanced threat protection, which detects anomalous activities such as potential SQL injection, brute-force attempts, and unusual access patterns, and raises security alerts. Option E (Vulnerability assessment) is correct because Defender for SQL provides a built-in vulnerability assessment that scans Azure SQL databases for misconfigurations, missing security updates, and other weaknesses, with findings surfaced in Defender for Cloud. Option A (File integrity monitoring) is not correct here because FIM applies to files and registry keys on servers/VMs (via Defender for Servers/Log Analytics), not to Azure SQL database workload protection. Option B (Adaptive network hardening) is not correct because it is a Defender for Cloud feature for virtual machines that analyzes network security group rules and traffic patterns, not a SQL database protection feature. Option C (Just-in-time VM access) is not correct because JIT VM access is a Defender for Servers capability that locks down management ports on VMs, not an Azure SQL database workload protection feature.

Answer

File integrity monitoring (FIM)

Answer

Adaptive network hardening

Answer

Just-in-time VM access

Question 5

Refer to the exhibit. You are reviewing a scheduled analytics rule in Microsoft Sentinel that uses the KQL query shown. The rule is configured to run every hour. A security analyst reports that the rule is generating too many incidents. What is the most likely cause?

Accepted Answer

The query does not filter out known safe IP addresses sufficiently.. The query likely uses a broad filter for sign-in events without excluding known safe IP addresses (e.g., corporate VPNs, trusted services). This causes every sign-in from those IPs to generate an incident, overwhelming the rule with false positives. The rule's frequency (every hour) is not the issue; the query logic is insufficiently scoped.

Answer

The rule is configured to run too frequently.

Answer

The query uses 'ago(1h)' which includes data from the previous hour, causing duplicate incidents.

Answer

The query has a syntax error that causes all sign-ins to match.

Question 6

Refer to the exhibit. You are assigning a built-in Azure Policy definition to a subscription using Azure CLI. The policy is 'Audit VMs that do not use managed disks'. After assignment, you check in Microsoft Defender for Cloud and see that the policy is not generating any recommendations. What is the most likely reason?

Accepted Answer

The policy is not part of a Defender for Cloud security initiative.. Microsoft Defender for Cloud only generates security recommendations from policies that are part of a built-in or custom security initiative (such as the 'Microsoft cloud security benchmark' initiative). A standalone policy assignment, even if it has the 'Audit' effect, will not appear as a recommendation in Defender for Cloud unless it is included in an initiative that Defender for Cloud monitors.

Answer

The policy effect is set to 'Audit', but it should be 'Deny' to generate recommendations.

Answer

The policy requires a managed identity to run.

Answer

The policy is assigned to the wrong subscription.

Question 7

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to create a custom analytic rule that triggers an incident when a user signs in from an unfamiliar location. Which data source should you use?

Accepted Answer

Microsoft Entra ID Sign-in Logs. Microsoft Entra ID Sign-in Logs contain detailed information about user sign-in events, including location data. A custom analytic rule in Microsoft Sentinel can use these logs to detect sign-ins from unfamiliar locations by comparing the location against a user's typical sign-in pattern, which is a common UEBA (User and Entity Behavior Analytics) scenario.

Answer

Azure Activity Logs

Answer

Azure AD Audit Logs

Answer

Microsoft 365 Defender Alerts

Question 8

A company has enabled Microsoft Defender for Cloud on all subscriptions. The security team wants to ensure that all virtual machines have vulnerability assessment solutions installed. What should they configure?

Accepted Answer

Enable the Vulnerability Assessment solution in Defender for Cloud and set it to 'On'. Microsoft Defender for Cloud provides a built-in Vulnerability Assessment solution that can be enabled at the subscription level. When set to 'On', it automatically deploys the Qualys or Microsoft threat and vulnerability management agent to all supported Azure VMs, ensuring continuous vulnerability scanning without manual intervention.

Answer

Enable Azure Update Management for all VMs

Answer

Create an Azure Policy to audit VMs without vulnerability assessment

Answer

Use Azure Automation to run a script that installs a vulnerability scanner

Question 9

A financial services company uses Microsoft Sentinel to detect ransomware activity. They want to correlate alerts from multiple sources to reduce false positives. They have enabled Microsoft Defender for Cloud, Microsoft Defender XDR, and Azure Firewall logs. Which Sentinel feature should they use to create a single alert from multiple signals?

Accepted Answer

Fusion (machine learning) rules. Fusion (machine learning) rules in Microsoft Sentinel are specifically designed to correlate alerts from multiple sources—such as Microsoft Defender for Cloud, Microsoft Defender XDR, and Azure Firewall logs—by using machine learning models to identify multi-stage attack patterns and reduce false positives. This makes Fusion the correct choice for creating a single alert from multiple signals, as it automatically combines related alerts into a single, high-fidelity incident.

Answer

Near-real-time (NRT) rules

Answer

Anomaly detection rules

Answer

Scheduled query rules

Question 10

Your organization uses Microsoft Defender for Cloud to protect Azure resources. You need to ensure that storage accounts are only accessible via HTTPS. What should you configure?

Accepted Answer

Enable 'Secure transfer required' in the storage account's configuration. Enabling 'Secure transfer required' on a storage account enforces HTTPS for all requests to the storage account, rejecting any HTTP traffic. This setting ensures that data in transit is encrypted using TLS, which aligns with the requirement to only allow HTTPS access.

Answer

Configure a storage account firewall to block HTTP

Answer

Use a private endpoint for the storage account

Answer

Create an Azure Policy to audit storage accounts that do not require secure transfer

Question 11

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically respond to phishing emails detected by Microsoft Defender XDR. They want to create a playbook that, when triggered, will delete the email from all recipients' mailboxes. Which integration should the playbook use?

Accepted Answer

Microsoft Graph API. The Microsoft Graph API provides the necessary endpoints to programmatically access and manipulate Exchange Online mail items, including deleting emails from user mailboxes. A Sentinel playbook can use an HTTP trigger with the Graph API to perform the deletion action on behalf of the security team, enabling automated remediation of phishing emails across all recipients.

Answer

Microsoft Power Automate

Answer

Exchange Online PowerShell

Answer

Microsoft 365 Defender API

Question 12

Which THREE of the following are features of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM)?

Accepted Answer

Security recommendations for resources. CSPM in Microsoft Defender for Cloud continuously assesses Azure resources against built-in security policies and industry best practices, generating actionable security recommendations to harden the environment. These recommendations are derived from the Azure Security Benchmark and are displayed in the Recommendations blade, directly influencing the Secure Score.

Answer

Vulnerability scanning of containers

Answer

Threat detection for VMs

Question 13

Which TWO of the following data connectors are available by default in Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (Option C) is a default data connector in Microsoft Sentinel because it provides native integration for streaming Microsoft Entra ID audit logs and sign-in logs directly into Sentinel without requiring additional licensing or configuration beyond enabling the connector. This is a core Microsoft source that is automatically available in the Sentinel data connector gallery.

Answer

Palo Alto Networks

Answer

ServiceNow

Answer

Amazon Web Services (AWS)

Question 14

Your organization uses Microsoft Sentinel to detect threats across multiple Azure subscriptions. Security analysts need to query threat intelligence data from Microsoft Defender Threat Intelligence (MDTI) directly within Sentinel. However, analysts report that MDTI indicators are not appearing in ThreatIntelligenceIndicator table. What is the most likely cause?

Accepted Answer

The MDTI data connector is not enabled in Microsoft Sentinel.. The most likely cause is that the MDTI data connector is not enabled in Microsoft Sentinel. Without enabling this connector, threat intelligence indicators from Microsoft Defender Threat Intelligence will not be ingested into the ThreatIntelligenceIndicator table, regardless of other configurations. The connector must be explicitly installed and configured to pull MDTI data into the workspace.

Answer

The Sentinel workspace is located in a region where MDTI is not supported.

Answer

The subscriptions are not onboarded to Microsoft Defender for Cloud.

Answer

The Sentinel workspace is not using Azure Lighthouse for cross-subscription management.

Question 15

A security analyst receives a high-severity alert in Microsoft Sentinel indicating a potential brute-force attack against an Azure VM. The analyst wants to automatically block the attacker IP for 24 hours. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Sentinel that runs a playbook to add a deny NSG rule.. It leverages Microsoft Sentinel's automation rules to trigger a playbook that programmatically adds a deny Network Security Group (NSG) rule, blocking the attacker's IP for a specified duration. This is the most efficient approach as it automates the response without manual intervention, directly modifying the NSG attached to the VM's subnet to drop inbound traffic from the malicious IP.

Answer

Enable Just-in-Time VM access to restrict all RDP traffic.

Answer

Create an Azure Policy to deny all traffic from the attacker IP.

Answer

Manually add a deny rule to the NSG attached to the VM's subnet.