AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 14 — 15 Questions

Question 1

You have a Microsoft Sentinel workspace that ingests data from multiple sources, including Azure Activity, Microsoft Entra ID, and Azure Firewall. You need to create a custom analytics rule that detects when a user signs in from an IP address that has been flagged as malicious in a threat intelligence feed. You have already imported threat intelligence indicators into Sentinel using the 'Threat Intelligence - TAXII' data connector. The threat intelligence indicators are stored in the 'ThreatIntelligenceIndicator' table. Which KQL function should you use in the analytics rule to match sign-in logs against the threat indicators?

Accepted Answer

threat_intelligence_check_ip. The function that matches IP addresses against threat intelligence indicators is 'threat_intelligence_check_ip'. Option C is correct. Option A is for matching URLs. Option B is not a valid function. Option D checks for IP matches but is not specific to threat intelligence.

Answer

threat_intelligence_check_url

Answer

threat_intelligence_check_hash

Answer

ipv4_lookup

Question 2

You are configuring Microsoft Defender for Cloud's 'Workload protections' for a Kubernetes cluster that is already using Azure Kubernetes Service (AKS). The cluster has 'Azure Policy' enabled. You need to enable the 'Microsoft Defender for Containers' plan to protect the cluster. You have already enabled the plan at the subscription level. However, the cluster is not showing as protected in the 'Inventory' blade. You have confirmed that the 'Azure Policy for Kubernetes' add-on is installed. What should you do to ensure the cluster is protected?

Accepted Answer

Install the 'Defender profile' on the AKS cluster.. Even with the subscription-level plan enabled, you need to install the 'Defender profile' on the AKS cluster. Option D is correct. Option A is incorrect because the cluster is not protected yet. Option B is incorrect because enabling Azure Policy for Kubernetes is a separate step. Option C is incorrect because the agents are deployed via the Defender profile.

Answer

Enable the 'Azure Policy for Kubernetes' add-on on the cluster.

Answer

Wait for 24 hours for the protection to automatically apply.

Answer

Install the Log Analytics agent on the cluster nodes.

Question 3

Your organization uses Microsoft Sentinel for security operations. You need to create a custom analytics rule that triggers an incident when a user executes a suspicious PowerShell command on a Windows server. The logs are stored in the 'DeviceEvents' table from Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). The rule should run every 5 minutes. Which scheduling frequency and query period should you configure?

Accepted Answer

Run query every 5 minutes with a query period of 5 minutes. For a rule that runs every 5 minutes, the query period should be set to 5 minutes to avoid duplication. Option B is correct. Option A would cause overlapping queries. Option C and D are not suitable for a 5-minute frequency.

Answer

Run query every 10 minutes with a query period of 5 minutes

Answer

Run query every 5 minutes with a query period of 1 minute

Answer

Run query every 5 minutes with a query period of 10 minutes

Question 4

You are a security engineer for a large enterprise using Microsoft Sentinel. You have multiple workspaces deployed across different Azure regions to meet data residency requirements. You need to query data across all workspaces from a single query. You have set up a workspace as the 'central' workspace for cross-workspace queries. The central workspace has the necessary permissions to access the other workspaces. Which KQL operator should you use to include data from other workspaces in your query?

Accepted Answer

union. The 'union' operator can be used with a workspace expression to combine data from multiple workspaces. Option A is correct. Option B is for joining tables. Option C is for filtering. Option D is for creating subsets.

Answer

where

Answer

join

Answer

project

Question 5

You are the security engineer for a multinational company that uses Azure to host critical workloads. The company has deployed Microsoft Defender for Cloud with the enhanced security features enabled on all subscriptions. Recently, a security audit revealed that several virtual machines (VMs) in the production environment are missing critical security updates. The audit report indicates that the VMs are not being assessed for missing updates by Defender for Cloud. You need to ensure that all VMs are automatically assessed for missing OS updates using Defender for Cloud's vulnerability assessment capabilities. The solution must minimize administrative overhead and should not require manual installation of agents on existing VMs. What should you do?

Accepted Answer

Enable the 'Servers' plan in Defender for Cloud and ensure that the 'Vulnerability assessment for machines' setting is turned on.

Answer

Enable the 'SQL servers on machines' plan in Defender for Cloud.

Answer

Configure a vulnerability assessment solution from the Azure Marketplace and assign it to the VMs.

Answer

Deploy the Log Analytics agent to all VMs using Azure Policy.

Question 6

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to create a custom analytics rule that detects when a user account is created in Microsoft Entra ID and then, within 24 hours, that account is granted a privileged role (e.g., Global Administrator). You have set up the necessary data connectors to ingest Microsoft Entra ID audit logs and sign-in logs into Sentinel. The rule should trigger an incident with high severity when this sequence occurs. Which KQL query should you use in the analytics rule?

Accepted Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated <= 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated > 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=leftouter (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated > 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].displayName == $right.TargetResources[0].displayName | where TimeGenerated <= 24h

Question 7

Your company has deployed Microsoft Defender for Cloud in all subscriptions. You need to ensure that all Azure SQL databases are protected by Advanced Threat Protection (ATP). You want to enable ATP at the subscription level so that new databases are automatically protected. The security policy must be enforced to prevent administrators from disabling ATP on individual databases. What should you do?

Accepted Answer

Create a custom Azure Policy with a 'Deny' effect that prevents setting the Advanced Threat Protection setting to 'Disabled' on SQL databases.. Option B is correct because it uses a custom Azure Policy with a 'Deny' effect to enforce that Advanced Threat Protection (ATP) cannot be disabled on any SQL database, including new ones. This approach ensures that the security policy is enforced at the subscription level, preventing administrators from turning off ATP on individual databases, which aligns with the requirement for automatic protection and enforcement.

Answer

Create an Azure Policy assignment using the built-in policy 'Advanced Threat Protection should be enabled on your SQL servers' with a 'Deny' effect.

Answer

Enable the 'Azure SQL databases' plan in Defender for Cloud at the subscription level.

Answer

Create an Azure Policy assignment that audits if Advanced Threat Protection is enabled on SQL databases, and remediate non-compliant resources.

Question 8

Your organization uses Microsoft Sentinel to monitor security events. You need to configure automated response actions for incidents. Which TWO of the following can be used to trigger automated responses in Microsoft Sentinel?

Accepted Answer

Automation rules. Option A (Playbooks) are automated workflows that can be triggered from analytics rules. Option B (Automation rules) centrally manage automated responses. Option C (Workbooks) are visualizations, not automated responses. Option D (Watchlists) are data sources. Option E (Hunting queries) are proactive searches, not automated responses.

Answer

Workbooks

Answer

Watchlists

Answer

Hunting queries

Question 9

You are configuring Microsoft Defender for Cloud to protect an Azure Kubernetes Service (AKS) cluster. The cluster runs sensitive workloads. You need to enable threat detection and vulnerability assessment for the AKS environment. Which THREE of the following should you enable?

Accepted Answer

Microsoft Defender for Containers plan. Option A (Defender for Containers) is the correct plan for AKS threat detection. Option B (Defender for Servers) is for VMs, not containers. Option C (Microsoft Defender for Cloud's vulnerability assessment for container images) is part of Defender for Containers. Option D (Azure Policy add-on for AKS) enables policy enforcement but is not threat detection. Option E (Microsoft Defender for Cloud's continuous export) is for exporting alerts, not detection.

Answer

Microsoft Defender for Servers plan

Answer

Azure Policy add-on for AKS

Question 10

A company uses Microsoft Defender for Cloud to protect its hybrid workloads. Security administrators report that critical alerts for SQL servers are not appearing in the Defender for Cloud dashboard. The SQL servers are on-premises and have Azure Arc enabled. Which configuration step should be verified first?

Accepted Answer

Enable the 'SQL servers on machines' plan in Microsoft Defender for Cloud. Option B is correct because for on-premises SQL servers with Azure Arc, the SQL servers must be registered as Azure Arc-enabled SQL Server instances and the Microsoft Defender for Cloud plan for SQL servers must be enabled at the subscription level. Option A is wrong because Azure Policy can enforce but doesn't directly cause missing alerts. Option C is wrong because Log Analytics workspace is used for data collection, but the core issue is plan enablement. Option D is wrong because Azure Firewall logs are unrelated to SQL specific alerts.

Answer

Deploy the Log Analytics agent to the SQL servers

Answer

Configure Azure Firewall logs for SQL traffic

Answer

Assign the 'Configure Azure Defender for SQL agents on virtual machines' policy

Question 11

A security operations team uses Microsoft Sentinel to monitor sign-in logs. They receive frequent false positive alerts for 'Anonymous IP address sign-in' from a specific external IP range used by a trusted partner. The analysts want to suppress these alerts without reducing detection coverage. What is the most efficient approach?

Accepted Answer

Create an alert suppression rule for the specific IP range in the analytics rule. Option C is correct because creating an alert suppression rule in Microsoft Sentinel allows analysts to suppress alerts from specific IP ranges without modifying the underlying analytics rule. Option A is wrong because disabling the analytics rule removes detection entirely. Option B is wrong because watchlists are used for correlation, not suppression. Option D is wrong because automation rules can run actions but not suppress alerts directly; suppression is a built-in feature of analytics rules.

Answer

Add the trusted IP range to a watchlist and reference it in the analytics rule query

Answer

Use an automation rule to close the incidents automatically

Answer

Disable the analytics rule that generates the alert

Question 12

A company is deploying Microsoft Sentinel in a new Azure subscription. The security team wants to ingest Windows security events from on-premises servers. Which data connector should they use?

Accepted Answer

Windows Security Events via AMA (Azure Monitor Agent). Option A is correct because the Windows Security Events via AMA connector is the current recommended method for streaming Windows security events to Azure Sentinel using the Azure Monitor Agent. Option B is wrong because the Azure Active Directory connector is for Microsoft Entra ID logs, not Windows events. Option C is wrong because the Office 365 connector is for Office logs. Option D is wrong because the Common Event Format (CEF) connector is for syslog from security appliances, not Windows security events.

Answer

Office 365 connector

Answer

Azure Active Directory connector

Answer

Common Event Format (CEF) connector

Question 13

Your organization has enabled Microsoft Defender for Cloud on all subscriptions. You need to ensure that the security score is improved by implementing recommendations. Which TWO actions would directly improve the secure score?

Accepted Answer

Remediate a high-severity recommendation for a SQL database. Options A and E are correct because remediating a high-severity recommendation increases the secure score, and enabling automatic provisioning of the Log Analytics agent is a recommendation that, when implemented, increases the score. Option B is wrong because enabling Just-In-Time VM access is a security control but does not directly affect the score; it may be a recommendation, but not all controls are scored. Option C is wrong because assigning Azure Policy does not directly improve the score; the score improves when resources comply. Option D is wrong because configuring email notifications does not affect the score.

Answer

Enable Just-In-Time VM access on all virtual machines

Answer

Configure email notifications for high-severity alerts

Answer

Assign a custom Azure Policy initiative

Question 14

A SOC team uses Microsoft Sentinel. They want to create an analytics rule that detects excessive failed logons from a single IP address. The rule must run every 5 minutes and look back 1 hour. Which THREE components are required to configure this scheduled query rule?

Accepted Answer

Kusto Query Language (KQL) query. Options A, C, and E are correct. A KQL query defines the detection logic (A). An incident configuration is required to create incidents from alerts (C). An alert threshold (e.g., 'Generate alert based on number of results') is required to specify the number of failed logons that trigger an alert (E). Option B is wrong because a playbook is optional, not required. Option D is wrong because a fusion rule is a different type of analytics rule, not a component of a scheduled query rule.

Answer

Fusion rule

Answer

Playbook

Question 15

Refer to the exhibit. You are assigned a policy that deploys the Log Analytics agent to Linux VMs. After assigning this policy to a subscription, you notice that existing Linux VMs are not getting the agent deployed, but newly created VMs receive the agent. What is the most likely reason?

Accepted Answer

The policy assignment requires a remediation task to be created for existing non-compliant VMs. Option A is correct because the policy uses 'deployIfNotExists' effect, which requires remediation tasks to be triggered on existing resources; the policy assignment does not automatically remediate existing VMs. Option B is wrong because the policy evaluates all VMs regardless of region. Option C is wrong because the policy does not require a managed identity for deployment; the 'deployIfNotExists' effect uses the system-assigned identity. Option D is wrong because the workspace ID is a required parameter, and if not provided, the assignment would fail.

Answer

The policy only applies to VMs in specific regions

Answer

The workspace ID parameter was not specified during assignment

Answer

The policy requires a managed identity to deploy the extension