AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 16 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel to monitor security events. You need to configure automated response actions for incidents. Which TWO of the following can be used to trigger automated responses in Microsoft Sentinel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created or updated, based on conditions like severity or specific analytics rules. They can run playbooks (Azure Logic Apps) to execute complex workflows, such as sending notifications or creating tickets, without manual intervention.

Answer

Workbooks

Answer

Watchlists

Answer

Hunting queries

Question 2

A company uses Microsoft Defender for Cloud to protect its hybrid workloads. Security administrators report that critical alerts for SQL servers are not appearing in the Defender for Cloud dashboard. The SQL servers are on-premises and have Azure Arc enabled. Which configuration step should be verified first?

Accepted Answer

Enable the 'SQL servers on machines' plan in Microsoft Defender for Cloud. For on-premises SQL servers with Azure Arc, the 'SQL servers on machines' plan must be enabled in Microsoft Defender for Cloud to surface alerts. Without enabling this plan, alerts for SQL servers will not appear. Options A and C are related to agent deployment and policy assignment, but the first step is to ensure the plan is enabled. Option B is unrelated as Azure Firewall logs are not required for SQL-specific alerts.

Answer

Deploy the Log Analytics agent to the SQL servers

Answer

Configure Azure Firewall logs for SQL traffic

Answer

Assign the 'Configure Azure Defender for SQL agents on virtual machines' policy

Question 3

A company is deploying Microsoft Sentinel in a new Azure subscription. The security team wants to ingest Windows security events from on-premises servers. Which data connector should they use?

Accepted Answer

Windows Security Events via AMA (Azure Monitor Agent). The Windows Security Events via AMA connector is the current recommended method for streaming Windows security events to Azure Sentinel using the Azure Monitor Agent. Option B is wrong because the Microsoft Entra ID connector is for Microsoft Entra ID logs, not Windows events. Option C is wrong because the Office 365 connector is for Office logs. Option D is wrong because the Common Event Format (CEF) connector is for syslog from security appliances, not Windows security events.

Answer

Office 365 connector

Answer

Azure Active Directory connector

Answer

Common Event Format (CEF) connector

Question 4

A company uses Microsoft Sentinel to centralize security logs. They need to ensure that incidents from Microsoft Defender XDR are synchronized into Sentinel. Which data connector should they enable?

Accepted Answer

Microsoft Defender XDR connector. The Microsoft Defender XDR connector (option C) is the correct choice because it is the built-in Microsoft Sentinel data connector designed to ingest and synchronize incidents and alerts from Microsoft Defender XDR into Sentinel, enabling unified incident management across Defender products. The Office 365 connector (option A) only ingests Office 365 audit and activity logs, not Defender XDR incidents. The Windows Security Events connector (option B) collects Windows event logs from agents, and the Azure Activity connector (option D) ingests Azure subscription control-plane activity, neither of which synchronizes Defender XDR incidents.

Answer

Office 365 connector

Answer

Windows Security Events connector

Answer

Azure Activity connector

Question 5

You manage security for a company using Microsoft Sentinel. The security team wants to automatically assign incidents to the on-call analyst based on the incident severity and the entity involved. They also want to ensure that when an incident is updated, the assignment is re-evaluated. You need to configure this with minimal administrative effort. What should you use?

Accepted Answer

Create an automation rule that triggers on incident creation and update, with conditions based on severity and entity, and an action to assign the incident to the on-call analyst.. Automation rules in Microsoft Sentinel are the native mechanism for incident management, allowing automatic assignment based on conditions such as severity and entities. They can trigger on both incident creation and update, ensuring re-evaluation when incidents change. This approach requires minimal effort because it is built into the platform and does not require custom playbook development.

Answer

Configure the analytics rule to include the owner in the incident details, and use a scheduled query to update the owner periodically.

Answer

Create a playbook that uses the Microsoft Sentinel connector to assign the incident, and configure the analytics rule to run the playbook on incident creation.

Answer

Use Microsoft Defender for Cloud's workflow automation to assign the incident to the on-call analyst based on severity.

Question 6

You are a security engineer at a company that uses Microsoft Sentinel. You need to create an automation rule that assigns a specific owner to incidents generated from a particular analytics rule and adds a comment. The automation rule must run when an incident is created. What should you use to define the condition?

Accepted Answer

A Microsoft Sentinel automation rule with a condition based on the analytics rule name.. Microsoft Sentinel automation rules are designed to automate incident handling. They can trigger on incident creation and evaluate conditions such as the analytics rule name. When the condition matches, the rule can assign an owner and add a comment. Playbooks are for more complex orchestration and are invoked by automation rules, but the condition and simple actions are defined in the automation rule itself.

Answer

A playbook that uses the incident creation trigger and a condition action.

Answer

A workbook that monitors incident metrics and triggers an alert.

Answer

A Microsoft Sentinel analytics rule with incident grouping enabled.

Question 7

You are a security engineer for a company that uses Microsoft Defender for Cloud. The security team wants to automatically trigger a Logic App playbook when a high-severity alert is generated for an Azure Storage account. The playbook must run without manual intervention. What should you configure?

Accepted Answer

Create an automation rule in Microsoft Defender for Cloud that triggers the playbook on alerts with severity High and resource type Storage accounts.. Automation rules in Microsoft Defender for Cloud are the native way to automatically respond to security alerts. They can filter by alert severity, resource type, and other properties, and then trigger a Logic App playbook. This provides a no-code, scalable solution that meets the requirement for automatic execution without manual intervention. Other options either require custom code or apply to the wrong resource type.

Answer

Configure a diagnostic setting to stream alerts to an event hub and use Azure Functions to invoke the playbook.

Answer

Enable just-in-time (JIT) VM access on the storage account and attach the playbook to the JIT policy.

Answer

Create an Azure Monitor action group that triggers the playbook when an alert is fired, and assign the action group to the storage account.

Question 8

You are a security engineer managing a Microsoft Sentinel workspace. The security operations team wants to automatically create a ServiceNow incident whenever a new high-severity incident is generated in Microsoft Sentinel. You need to configure the automation rule to trigger only for incidents with severity High and to include the incident's entities in the ServiceNow ticket. What should you do first?

Accepted Answer

Create a playbook that uses the ServiceNow connector, then create an automation rule with the condition Severity equals High and add an action to run the playbook.. Automation rules in Microsoft Sentinel allow you to define conditions and actions that run when incidents are created or updated. To integrate with ServiceNow, you must first create a playbook that contains the logic to create a ServiceNow incident, using the ServiceNow connector. Then, you create an automation rule that triggers on High severity incidents and runs that playbook. This ensures that only high-severity incidents result in ServiceNow tickets, and the playbook can access incident entities to populate the ticket details.

Answer

Enable the Microsoft Sentinel data connector for ServiceNow and configure the connector to automatically create incidents for all high-severity alerts.

Answer

Create an analytics rule that generates an incident and configure its incident settings to run a playbook automatically.

Answer

Create a workbook that monitors incidents and use Azure Logic Apps to send an email to the security team when a high-severity incident occurs.

Question 9

You are configuring Microsoft Defender for Cloud for an Azure subscription. You want to receive email notifications when a high-severity alert is generated. What should you configure?

Accepted Answer

The Email notifications settings in Microsoft Defender for Cloud.. Microsoft Defender for Cloud includes a built-in email notification feature that allows you to specify recipients and severity levels for alerts. This is the simplest and most direct method to receive email notifications for high-severity alerts. It does not require additional services like Azure Monitor, Microsoft Sentinel, or Log Analytics, and it is designed specifically for this purpose.

Answer

Azure Monitor action groups with an email action.

Answer

A Microsoft Sentinel analytics rule with an email playbook.

Answer

A Log Analytics workspace with a scheduled query alert.

Question 10

You are a security analyst using Microsoft Defender for Cloud. You need to ensure that any new Azure subscription added to your management group automatically receives the default security policy assignments and that security recommendations are continuously assessed. What should you enable?

Accepted Answer

Azure Policy initiative assignment at the management group scope.. To ensure that new subscriptions automatically receive security policy assignments and continuous assessment, you should assign the appropriate Azure Policy initiative (such as the Microsoft cloud security benchmark) at the management group level. Subscriptions within that management group inherit the policy, and Defender for Cloud continuously evaluates resources against the policy, providing recommendations. This centralized approach simplifies governance and ensures compliance across all subscriptions without manual intervention.

Answer

Azure Arc enrollment for all servers in the subscriptions.

Answer

Microsoft Sentinel workspace onboarding for each subscription.

Answer

Microsoft Defender for Cloud auto-provisioning of the Log Analytics agent.

Question 11

You are using Microsoft Sentinel to monitor security events. You need to create a custom analytics rule that detects when a user account is added to a privileged group. The rule should run every 5 minutes and generate an incident. Which query language and data source should you use?

Accepted Answer

KQL against the AuditLogs table.. To detect user account additions to privileged groups, you need Microsoft Entra ID audit logs, which are stored in the AuditLogs table in Microsoft Sentinel. KQL is the query language for analytics rules. The AuditLogs table captures group management activities, including additions to privileged roles. The rule can be scheduled to run every 5 minutes and generate incidents when the condition is met.

Answer

KQL against the AzureActivity table.

Answer

KQL against the SigninLogs table.

Answer

KQL against the SecurityEvent table.

Question 12

You are configuring Microsoft Defender for Cloud for a subscription that contains Azure Kubernetes Service (AKS) clusters. You need to ensure that Defender for Containers provides vulnerability assessment for container images stored in Azure Container Registry (ACR). What should you enable?

Accepted Answer

Enable the Defender for Containers plan and ensure that the ACR integration is turned on, then grant the Defender for Cloud service principal the AcrPull role on the registry.. Defender for Containers is the correct plan for protecting AKS clusters and container images in ACR. Enabling the plan and the ACR integration, along with granting the service principal AcrPull permissions, allows Defender for Cloud to scan images for vulnerabilities. The other plans target different resource types and do not include container image assessment.

Answer

Enable the Defender for App Service plan and configure the ACR integration from the App Service environment.

Answer

Enable the Defender for Storage plan and configure a private endpoint to ACR.

Answer

Enable the Defender for Servers plan and deploy the Log Analytics agent to all AKS nodes.

Question 13

You are a security analyst in a company that uses Microsoft Sentinel. You need to create a hunting query that identifies failed sign-in attempts from a specific IP address range and then automatically create an incident if the count exceeds a threshold. Which Microsoft Sentinel feature should you use?

Accepted Answer

Create a scheduled analytics rule that runs the query and triggers an incident based on the threshold.. Scheduled analytics rules are the correct feature for automated detection and incident creation in Microsoft Sentinel. They allow you to define a query, set a schedule, and specify a threshold for generating incidents. When the query returns results exceeding the threshold, Sentinel creates an incident with the mapped entities. This is ideal for detecting patterns like multiple failed sign-ins from a specific IP range. Other features like hunting or workbooks do not provide this automated incident creation capability.

Answer

Configure a workbook that visualizes failed sign-ins and set up an alert rule in Azure Monitor to create an incident.

Answer

Create a playbook that runs the query on a schedule and sends an email to the security team.

Answer

Use the hunting dashboard to run the query and manually create an incident from the results.

Question 14

You manage a Microsoft Sentinel workspace. Your security operations team wants to automatically notify the on-call analyst via Microsoft Teams whenever a new high-severity incident is created, and also create a corresponding ticket in ServiceNow. The team does not want to write code. Which Microsoft Sentinel feature should you use to accomplish this?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel provide a no-code way to trigger playbooks based on incident creation, severity, or other conditions. By creating an automation rule that runs when a high-severity incident is created, you can launch a playbook that posts to Microsoft Teams and creates a ServiceNow ticket. This satisfies the requirement without writing code.

Answer

Workbooks

Answer

Watchlists

Answer

Analytics rules

Question 15

You administer an Azure environment with Microsoft Defender for Cloud enabled. A security analyst reports that a suspicious process was executed on a virtual machine, but no alert was found in the portal. You need to ensure that Defender for Cloud can detect and alert on suspicious activities on the VM. What should you do?

Accepted Answer

Ensure the Microsoft Defender for Servers plan is enabled and that the Azure Monitor Agent is installed on the VM.. To detect suspicious process execution on a VM, Defender for Cloud must have the Defender for Servers plan enabled, which deploys the Azure Monitor Agent and integrates with Microsoft Defender for Endpoint. This combination provides deep endpoint detection and response capabilities, including process-level monitoring. Other options either use outdated agents or focus on network controls, which do not fulfill the requirement.

Answer

Configure a custom alert rule in Azure Monitor to trigger on specific process creation events.

Answer

Enable the Log Analytics agent and configure a data collection rule to forward Security events.

Answer

Enable just-in-time (JIT) VM access to restrict inbound traffic and log connection attempts.