AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 15 — 15 Questions

Question 1

Your organization has a hybrid identity environment with Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You are using Microsoft Defender for Cloud to monitor security posture. You notice that the recommendation 'MFA should be enabled on accounts with owner permissions on your subscription' shows a status of 'Unhealthy' for some accounts, but those accounts already have Microsoft Entra Conditional Access policies requiring MFA. What is the most likely reason for the discrepancy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Defender for Cloud evaluates the 'per-user' MFA state, which is separate from Conditional Access.. The correct answer is C: Defender for Cloud evaluates the 'per-user' MFA state, which is separate from Conditional Access. Microsoft Defender for Cloud's MFA recommendation checks whether each account has MFA enabled at the per-user level in Microsoft Entra ID (the legacy per-user MFA setting), not whether Conditional Access policies enforce MFA at sign-in. Therefore, accounts protected only by Conditional Access can still appear 'Unhealthy' because their per-user MFA status remains disabled. Option A is wrong because the scenario states the Conditional Access policies require MFA, so the discrepancy is not caused by policy scope. Option B is wrong because guest users can be protected by MFA through Conditional Access. Option D is wrong because Azure subscription IAM does not configure MFA; MFA is an identity-level control in Microsoft Entra ID.

Answer

The Conditional Access policies are not applied to all users; some users bypass MFA.

Answer

The accounts are guest users from another tenant; MFA cannot be enforced.

Answer

The recommendation requires MFA to be configured in the subscription's access control (IAM) blade.

Question 2

Your security team is investigating a potential data exfiltration incident. They have identified that a user has been downloading large amounts of data from Azure Blob Storage to an external IP address. You need to create a Microsoft Sentinel analytics rule that triggers when more than 1 GB of data is downloaded from a storage account in a single hour. Which KQL query should be the basis of the rule?

Accepted Answer

StorageBlobLogs | where OperationName == 'GetBlob' | summarize TotalGB = sum(ResponseBodySize) / 1073741824 by bin(TimeGenerated, 1h) | where TotalGB > 1. It filters StorageBlobLogs to GetBlob operations, sums ResponseBodySize (which is in bytes) over a one-hour bin, converts the total to gigabytes by dividing by 1073741824, and then filters for totals greater than 1 GB — exactly matching the requirement to detect more than 1 GB downloaded per hour. Option B uses avg(ResponseBodySize), which measures the average size of individual downloads rather than the total volume, so it would not detect aggregate exfiltration. Option C checks each individual GetBlob event against 1 GB, missing the scenario where many smaller downloads sum to over 1 GB in an hour. Option D counts the number of GetBlob operations rather than bytes transferred, so it does not measure data volume at all.

Answer

StorageBlobLogs | where OperationName == 'GetBlob' | summarize avg(ResponseBodySize) by bin(TimeGenerated, 1h) | where avg_ResponseBodySize > 1073741824

Answer

StorageBlobLogs | where OperationName == 'GetBlob' and ResponseBodySize > 1073741824

Answer

StorageBlobLogs | where OperationName == 'GetBlob' | summarize count() by bin(TimeGenerated, 1h) | where count_ > 1000

Question 3

Your company wants to use Microsoft Defender for Cloud's just-in-time (JIT) VM access to reduce the attack surface. You have enabled JIT for a set of VMs. A security administrator reports that they cannot connect via RDP even after requesting access. What is the most likely cause?

Accepted Answer

The administrator's source IP address is not in the allowed list for the JIT policy.. The most likely cause is that the administrator's source IP address is not included in the allowed list for the JIT policy. When a user requests JIT access, Defender for Cloud opens the specified ports (e.g., 3389 for RDP) only to the source IP addresses that are explicitly permitted in the policy. If the administrator's IP is not in the allowed list, the request may be approved but the network security group (NSG) or Azure Firewall rule will not include that IP, resulting in a connection failure.

Answer

The JIT policy is set at the subscription level and does not apply to individual VMs.

Answer

The VM is not located in a region that supports JIT.

Answer

The VM does not have the Azure VM agent installed.

Question 4

Your organization wants to use Microsoft Sentinel to detect and respond to threats. You need to ensure that Sentinel can ingest data from Azure Firewall logs. Which three components are required? (Choose three.)

Accepted Answer

Enable diagnostic logs on Azure Firewall.. Azure Firewall logs must be enabled via diagnostic settings to send data to a Log Analytics workspace. Without diagnostic logs, the firewall does not produce the necessary log data for Sentinel to ingest. This is the foundational step for log collection.

Answer

Assign an Azure Policy to enforce diagnostic logs on all firewalls.

Answer

Install the Log Analytics agent on the Azure Firewall.

Question 5

Your company uses Microsoft Defender for Cloud to protect Azure resources. You want to enable the 'Defender for Containers' plan to secure AKS clusters. Which two configurations are necessary? (Choose two.)

Accepted Answer

Enable the 'Defender for Containers' plan in Microsoft Defender for Cloud.. Enabling the 'Defender for Containers' plan in Microsoft Defender for Cloud is the primary configuration required to activate threat detection and security monitoring for AKS clusters. Option E is correct because audit logs must be enabled and streamed to a Log Analytics workspace to provide the necessary data for Defender for Containers to analyze Kubernetes audit events and detect suspicious activities.

Answer

Assign the 'Kubernetes cluster should be accessible only through private endpoint' Azure Policy.

Answer

Connect the AKS cluster to Azure Arc.

Answer

Install the Log Analytics agent on each AKS node.

Question 6

Your organization has a complex Azure environment with multiple subscriptions, each containing hundreds of VMs and PaaS services. You are responsible for ensuring that all resources are monitored for security threats using Microsoft Defender for Cloud. The environment includes: - Subscription A: Production workloads, requires the highest security posture. - Subscription B: Development environment, has a lower security budget. - Subscription C: Shared services (e.g., DNS, Active Directory). You need to implement the most cost-effective security monitoring solution that meets the following requirements: - All subscriptions must be covered by Defender for Cloud. - Production subscription must have vulnerability assessment for VMs. - Development subscription does not need vulnerability assessment but must have basic CSPM. - Shared services subscription must have advanced threat protection for Azure SQL databases. - You must minimize administrative overhead and ensure that security policies are centrally managed. What should you do?

Accepted Answer

Enable the 'Defender Cloud Security Posture Management' (CSPM) plan on the management group that contains all subscriptions. Then, on Subscription A, enable the 'Defender for Servers' plan with vulnerability assessment. On Subscription C, enable the 'Defender for Azure SQL' plan. Leave Subscription B with only the CSPM plan.. Option B is correct because enabling the Defender Cloud Security Posture Management (CSPM) plan at the management group scope centrally covers all subscriptions with basic CSPM at no/low cost, while selectively enabling Defender for Servers with vulnerability assessment only on Subscription A and Defender for Azure SQL only on Subscription C matches each subscription's specific requirement and minimizes cost and administrative overhead. This scoped approach avoids paying for unnecessary plans on Subscription B, which only needs basic CSPM. Option A is wrong because enabling all Defender plans on the management group would incur costs for plans not required (e.g., vulnerability assessment on Subscription B) and then require extra policy work to disable them. Option C is wrong because disabling Defender for Cloud on Subscription B violates the requirement that all subscriptions be covered and that B have basic CSPM. Option D is wrong because the free tier does not provide the required vulnerability assessment for VMs or advanced threat protection for Azure SQL, and manual configuration increases administrative overhead.

Answer

Enable all Defender plans on the management group to cover all subscriptions, then disable vulnerability assessment on Subscription B via policy.

Answer

Enable the 'Defender for Servers' plan on Subscription A, 'Defender for Azure SQL' on Subscription C, and disable Defender for Cloud on Subscription B.

Answer

Enable only the free tier of Defender for Cloud on all subscriptions, then manually configure vulnerability assessment for VMs in Subscription A and advanced threat protection for SQL in Subscription C.

Question 7

Your company uses Microsoft Defender for Cloud's regulatory compliance dashboard to track compliance with the PCI DSS standard. You have enabled the PCI DSS initiative on the management group. The dashboard shows that some controls are 'Not started' even though you have implemented the required security configurations. You suspect that the assessment might not be running correctly. You need to ensure that the compliance assessments are triggered for all resources. The environment consists of: - 3 subscriptions under a management group. - All subscriptions have Defender for Cloud enabled with the CSPM plan. - The PCI DSS initiative was assigned at the management group level. - Some resources are in regions that do not support certain policy effects. What is the most likely reason for the 'Not started' status?

Accepted Answer

Some policies in the PCI DSS initiative use effects that are not supported in certain regions, causing the assessment to not run.. The correct answer is D: some policies in the PCI DSS initiative use effects that are not supported in certain regions, causing the assessment to not run. Azure Policy effects such as AuditIfNotExists or DeployIfNotExists depend on regional support and resource provider capabilities; if an effect is unsupported in a resource's region, the policy assignment cannot evaluate that resource, so the control remains 'Not started' rather than showing a compliant or non-compliant result. This matches the scenario's hint that some resources are in regions that do not support certain policy effects. Option A is wrong because Defender for Cloud continuously evaluates assigned initiatives and does not require manual assessment runs. Option B is wrong because an initiative assigned at the management group level is inherited by all subscriptions in that group. Option C is wrong because the scenario states Defender for Cloud with the CSPM plan is already enabled on all subscriptions.

Answer

The compliance dashboard only displays results if you manually run an assessment.

Answer

The PCI DSS initiative must be assigned to each subscription individually.

Answer

The Defender Cloud Security Posture Management (CSPM) plan is not enabled on all subscriptions.

Question 8

You have configured Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). You notice that sign-in logs for external guest users are not appearing in Sentinel. What is the most likely cause?

Accepted Answer

The diagnostic settings in Microsoft Entra ID are not configured to stream sign-in logs to the Log Analytics workspace used by Sentinel.. Microsoft Sentinel ingests Microsoft Entra ID (Entra ID) logs via diagnostic settings configured on the Entra ID tenant. These settings must explicitly stream sign-in logs (including guest user sign-ins) to a Log Analytics workspace. If the diagnostic settings are missing or misconfigured, no sign-in logs—including those for external guest users—will appear in Sentinel.

Answer

Microsoft Sentinel does not support ingestion of external guest user sign-in logs.

Answer

The Microsoft Sentinel Entra ID connector requires a separate connector for guest users.

Answer

Guest user sign-ins are not logged in Microsoft Entra ID.

Question 9

Your security team wants to use Microsoft Defender for Cloud's 'Just-In-Time (JIT) VM access' to reduce the attack surface. Which Azure policy must be enabled on the subscription to use JIT?

Accepted Answer

Microsoft Defender for Servers. Just-In-Time (JIT) VM access is a feature of Microsoft Defender for Cloud that requires the Microsoft Defender for Servers plan to be enabled on the subscription. This plan provides the advanced threat protection and access control capabilities, including JIT, which dynamically locks down inbound traffic to VMs and opens ports only when authorized users request access via Azure Policy or the portal.

Answer

Microsoft Defender for Databases

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Key Vault

Question 10

Which TWO actions can you perform using Microsoft Sentinel's UEBA (User and Entity Behavior Analytics) feature? (Choose two.)

Accepted Answer

Detect anomalous behavior based on historical user activity. Option D is correct because Microsoft Sentinel UEBA builds behavioral baselines from historical log data (sign-in, Azure Activity, Office 365, etc.) and uses machine learning to surface deviations from a user's own normal activity, such as unusual logon times or data volumes. Option E is correct because UEBA also performs peer-group analysis, comparing each user's actions against similar users in the organization to flag anomalous behavior that would not stand out against the user's own baseline. Options A, B, and C are not UEBA capabilities: blocking anonymous-IP sign-ins is done via Conditional Access or named-location policies, running KQL queries across multiple data sources is core Log Analytics/Sentinel hunting (not UEBA-specific), and automatically disabling compromised accounts requires automated response playbooks (Logic Apps) or identity protection tooling, not UEBA itself.

Answer

Block sign-ins from anonymous IP addresses

Answer

Run KQL queries to find threats across multiple data sources

Answer

Automatically disable compromised user accounts

Question 11

You are a security engineer for Contoso Ltd. The company has a hybrid environment with Azure VMs and on-premises servers running Windows Server 2022. You have enabled Microsoft Defender for Cloud's multi-cloud posture management for AWS and GCP. Recently, you deployed Microsoft Sentinel in a Log Analytics workspace named 'ContosoWorkspace'. The security team needs to centralize security alerts from all sources: Azure, on-premises, AWS, and GCP. They also require automated investigation and response for common threats. Specifically, they want to automatically disable a compromised user account when a high-severity alert is generated. You have configured data connectors for Azure Activity, Microsoft Entra ID, and AWS CloudTrail. For on-premises servers, you installed the Azure Monitor Agent (AMA) and enabled Defender for Cloud's plan for servers. For GCP, you are using the GCP Security Command Center connector. The team needs to create a playbook that runs when a high-severity alert from any source is triggered. The playbook should disable the user account in Microsoft Entra ID. You have created a playbook using Azure Logic Apps and granted it the necessary permissions. Which step should you take to ensure the playbook runs automatically when alerts are generated?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers the playbook when a high-severity alert is created.. The correct option is A: create an automation rule in Microsoft Sentinel that triggers the playbook when a high-severity alert is created. Automation rules in Microsoft Sentinel are the native mechanism for automatically invoking playbooks (Logic Apps) in response to incidents or alerts, and they can filter by severity so the playbook runs only for high-severity alerts. Option B is wrong because automation rules in Microsoft Defender for Cloud govern Defender for Cloud alerts and cannot directly trigger a Sentinel playbook for alerts from all connected sources. Option C is wrong because analytics rules generate alerts/incidents from ingested data; they do not trigger playbooks. Option D is wrong because a scheduled Logic App polling Sentinel would not provide the required automatic, event-driven response when an alert is generated.

Answer

Create an automation rule in Microsoft Defender for Cloud that triggers the playbook when a high-severity alert is generated.

Answer

Create an analytics rule in Microsoft Sentinel that triggers the playbook when a high-severity alert is created.

Answer

Configure the Logic App to run on a schedule and query Sentinel for high-severity alerts.

Question 12

Your company uses Microsoft Defender for Cloud's 'Vulnerability Assessment' solution for Azure VMs. You have enabled the 'Microsoft Defender for Servers' plan and deployed the integrated Qualys agent. You need to view the vulnerability assessment findings for all VMs in a single dashboard in Microsoft Defender for Cloud. Which blade in the Defender for Cloud portal should you navigate to?

Accepted Answer

Recommendations. The correct option is D, Recommendations. In Microsoft Defender for Cloud, vulnerability assessment findings from the integrated Qualys agent (part of the Defender for Servers plan) are surfaced as security recommendations, so navigating to the Recommendations blade lets you view and filter findings such as 'Vulnerabilities in your virtual machines should be remediated' across all VMs in one place. The Inventory blade only lists resources and their security posture, not aggregated vulnerability findings. Security alerts shows active threat detections rather than vulnerability assessment results. Regulatory compliance maps controls to standards and does not present the raw vulnerability findings dashboard.

Answer

Inventory

Answer

Security alerts

Answer

Regulatory compliance

Question 13

You are configuring Microsoft Defender for Cloud's 'Workload protections' for a Kubernetes cluster that is already using Azure Kubernetes Service (AKS). The cluster has 'Azure Policy' enabled. You need to enable the 'Microsoft Defender for Containers' plan to protect the cluster. You have already enabled the plan at the subscription level. However, the cluster is not showing as protected in the 'Inventory' blade. You have confirmed that the 'Azure Policy for Kubernetes' add-on is installed. What should you do to ensure the cluster is protected?

Accepted Answer

Install the 'Defender profile' on the AKS cluster.. Even with the subscription-level plan enabled, you need to install the 'Defender profile' on the AKS cluster to enable protection. The Defender profile deploys the necessary agents for threat detection. Option A is correct. Option B is incorrect because Azure Policy for Kubernetes is already enabled; it is a separate feature. Option C is incorrect because protection does not automatically apply; you must install the profile. Option D is incorrect because the Log Analytics agent is not required for Defender for Containers; the Defender profile handles agent deployment.

Answer

Enable the 'Azure Policy for Kubernetes' add-on on the cluster.

Answer

Wait for 24 hours for the protection to automatically apply.

Answer

Install the Log Analytics agent on the cluster nodes.

Question 14

You are a security engineer for a large enterprise using Microsoft Sentinel. You have multiple workspaces deployed across different Azure regions to meet data residency requirements. You need to query data across all workspaces from a single query. You have set up a workspace as the 'central' workspace for cross-workspace queries. The central workspace has the necessary permissions to access the other workspaces. Which KQL operator should you use to include data from other workspaces in your query?

Accepted Answer

union. The correct option is B, the union operator, because in Microsoft Sentinel and Azure Monitor Log Analytics, cross-workspace queries are performed by using union with workspace identifiers, such as union workspace("WorkspaceName").TableName, which combines rows from tables in the central workspace and the referenced workspaces into a single result set. This matches the scenario where the central workspace has permissions to query the other workspaces for data residency-compliant cross-region reporting. The where operator only filters rows within a single table and cannot reference another workspace, join correlates columns across tables but does not by itself aggregate multiple workspaces, and project only selects or renames columns from an existing result set. Therefore, union is the only operator that satisfies the requirement to include data from other workspaces in one query.

Answer

where

Answer

join

Answer

project

Question 15

You are the security engineer for a multinational company that uses Azure to host critical workloads. The company has deployed Microsoft Defender for Cloud with the enhanced security features enabled on all subscriptions. Recently, a security audit revealed that several virtual machines (VMs) in the production environment are missing critical security updates. The audit report indicates that the VMs are not being assessed for missing updates by Defender for Cloud. You need to ensure that all VMs are automatically assessed for missing OS updates using Defender for Cloud's vulnerability assessment capabilities. The solution must minimize administrative overhead and should not require manual installation of agents on existing VMs. What should you do?

Accepted Answer

Enable the 'Servers' plan in Defender for Cloud and ensure that the 'Vulnerability assessment for machines' setting is turned on.

Answer

Enable the 'SQL servers on machines' plan in Defender for Cloud.

Answer

Configure a vulnerability assessment solution from the Azure Marketplace and assign it to the VMs.

Answer

Deploy the Log Analytics agent to all VMs using Azure Policy.