AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to assess regulatory compliance. You need to ensure that the compliance dashboard reflects the latest standards and that custom assessments are included. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a custom regulatory compliance standard in Defender for Cloud.. Microsoft Defender for Cloud allows you to add custom regulatory compliance standards directly within the compliance dashboard. This enables you to include both built-in standards (e.g., SOC 2, ISO 27001) and custom assessments tailored to your organization's specific compliance requirements, ensuring the dashboard reflects the latest standards.

Answer

Configure Microsoft Purview compliance portal to include Azure subscriptions.

Answer

Use Azure Policy to apply custom definitions and assign to management groups.

Answer

Create an Azure Blueprint with custom policies.

Question 2

You are investigating a security incident in Microsoft Sentinel. A KQL query returns results indicating that a user logged in from an IP address that is not in the organization's approved list. The user's account has been compromised. You need to automatically disable the user account in Microsoft Entra ID when such an alert is triggered. What should you configure?

Accepted Answer

Create a playbook in Microsoft Sentinel with a Logic Apps connector to Microsoft Entra ID.. Microsoft Sentinel can use playbooks, which are automated workflows built on Azure Logic Apps, to respond to security alerts. By creating a playbook triggered by a Sentinel alert, you can use the Microsoft Entra ID connector to automatically disable a compromised user account, providing a direct and integrated remediation action.

Answer

Configure an Azure Policy that disables the user account.

Answer

Use Microsoft Defender for Cloud to automatically disable the account.

Answer

Create a Power Automate flow triggered by the Sentinel alert.

Question 3

Your company has multiple Azure subscriptions. You need to centralize security alerts and incidents in a single dashboard for the security operations center (SOC) team. The solution should provide advanced analytics and threat detection. Which service should you use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that centralizes security alerts and incidents from multiple Azure subscriptions into a single dashboard. It provides advanced analytics, built-in threat detection, and AI-driven investigation capabilities, making it ideal for a SOC team requiring a unified view across the enterprise.

Answer

Azure Monitor

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Cloud

Question 4

You are configuring Microsoft Defender for Cloud's continuous export feature. You need to export security alerts and recommendations to a Log Analytics workspace for long-term retention and custom analysis. The export should include only high-severity alerts and recommendations. What should you do?

Accepted Answer

Enable continuous export in Defender for Cloud and select high-severity alerts and recommendations.. Microsoft Defender for Cloud's continuous export feature allows you to directly export security alerts and recommendations to a Log Analytics workspace with granular filtering by severity. This meets the requirement for long-term retention and custom analysis without additional services. Selecting 'high-severity' in the export configuration ensures only the specified alerts and recommendations are exported.

Answer

Set up Microsoft Sentinel to ingest Defender for Cloud alerts and then export to the workspace.

Answer

Configure diagnostic settings on each Azure resource to send logs to the workspace.

Answer

Use Azure Event Hubs to stream security alerts to the workspace.

Question 5

You are reviewing the Azure Policy definition shown in the exhibit. This policy is assigned to a subscription. Several VMs are non-compliant. What is the most likely reason for the non-compliance?

Accepted Answer

The VMs do not have the Azure Disk Encryption extension installed.. The Azure Policy definition in the exhibit likely targets the 'Disk Encryption' built-in policy, which checks whether Azure Disk Encryption (ADE) is enabled on VMs. ADE uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt OS and data disks. If VMs are non-compliant, it means the Azure Disk Encryption extension is not installed or not properly configured on those VMs.

Answer

The VMs are not backed up to Azure Backup.

Answer

The VMs have encryption at host enabled but not Azure Disk Encryption.

Answer

The VMs are missing critical Windows security patches.

Question 6

Your organization uses Microsoft Defender for Cloud to assess regulatory compliance. You need to ensure that the compliance dashboard reflects the latest standards and that custom assessments are included. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign an Azure Policy with a DeployIfNotExists effect that deploys the required configuration.. Azure Policy with a DeployIfNotExists effect automatically deploys the required configuration when a resource is found non-compliant, ensuring remediation without manual intervention. This is a native, policy-driven approach that integrates directly with Defender for Cloud recommendations.

Answer

Create a Logic Apps playbook that runs on a schedule.

Answer

Configure Microsoft Sentinel to automatically remediate based on alerts.

Answer

Use Azure Automation runbooks to manually run remediation.

Question 7

You are designing a Microsoft Sentinel deployment for a multinational company. The company requires that all security logs be retained for at least seven years for compliance. The solution must be cost-effective. Which THREE actions should you take?

Accepted Answer

Configure the Log Analytics workspace retention to two years for interactive queries.. Log Analytics workspace retention can be set to two years for interactive queries, which is the maximum retention supported for direct querying. This balances cost and accessibility for recent data, while older logs can be moved to cheaper storage tiers. Microsoft Sentinel uses the Log Analytics workspace as its data store, so configuring retention here is a foundational step for cost-effective long-term retention.

Answer

Use continuous export to Azure Event Hubs for long-term storage.

Answer

Store logs in Azure SQL Database for seven years.

Question 8

Your company uses Microsoft Defender for Cloud to protect Azure resources. You need to enable the enhanced security features (formerly Azure Defender) for all supported resource types. Which TWO plans should you enable? (Choose TWO that apply.)

Accepted Answer

Servers. Enabling the 'Servers' plan in Microsoft Defender for Cloud provides enhanced security features (formerly Azure Defender) for Azure VMs, on-premises servers, and other compute resources. This plan includes threat detection, vulnerability assessment, and just-in-time access controls, which are essential for protecting server workloads.

Answer

Azure Active Directory

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Question 9

You execute the KQL query shown in the exhibit in Microsoft Sentinel. The query returns no results, but you know there have been high-severity malware alerts in the past week. What is the most likely issue?

Accepted Answer

The alert name is case-sensitive and does not exactly match 'Malware'.. KQL queries in Microsoft Sentinel are case-sensitive for string comparisons. The query likely uses a filter like `AlertName == 'Malware'`, but the actual alert name in the SecurityAlert table may be 'Malware' with exact casing. If the query uses a different case (e.g., 'malware' or 'MALWARE'), it will return no results even if high-severity malware alerts exist. This is a common pitfall when querying Sentinel's SecurityAlert table, where alert names are stored with specific casing.

Answer

The SecurityAlert table does not contain malware alerts.

Answer

The time range filter is incorrect.

Answer

There are no high-severity alerts in the past week.

Question 10

You run the PowerShell command shown in the exhibit. After execution, you check the Log Analytics workspace in the Azure portal. The workspace is created successfully. However, when you try to onboard the workspace to Microsoft Sentinel, you receive an error that Sentinel cannot be enabled on this workspace. What is the most likely cause?

Accepted Answer

The workspace is in a region that does not support Microsoft Sentinel.. Microsoft Sentinel is not available in all Azure regions. The error 'Sentinel cannot be enabled on this workspace' most commonly occurs when the Log Analytics workspace is deployed in a region that does not support Sentinel. Even though the workspace is created successfully, Sentinel requires specific regional availability, and if the workspace region is not in the supported list, onboarding will fail.

Answer

The SKU is set to PerGB2018, which is not compatible with Sentinel.

Answer

The resource group location is different from the workspace location.

Answer

The retention period is set to 365 days, which exceeds the maximum for Sentinel.

Question 11

You deploy the Bicep template shown in the exhibit. After deployment, you check Microsoft Sentinel and find it is not enabled. The Log Analytics workspace and Defender for Cloud pricing plan are created successfully. What is the most likely reason Sentinel is not enabled?

Accepted Answer

The sentinel resource does not reference the workspace, so it is not linked.. Microsoft Sentinel requires an explicit resource definition that references the Log Analytics workspace via the `workspaceId` property. Without this linkage, the Sentinel resource is not connected to the workspace, and Sentinel remains disabled even if the workspace and Defender for Cloud pricing plan are deployed successfully.

Answer

The Defender for Cloud pricing tier is set to 'Standard' but should be 'Free' for Sentinel.

Answer

The workspace retention is set to 90 days, but Sentinel requires at least 180 days.

Answer

The Log Analytics workspace SKU is set to 'PerGB2018' but Sentinel requires 'PerNode'.

Question 12

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. The security team receives an alert about a critical vulnerability in an Azure VM that was remediated two weeks ago. What is the most likely reason the alert is still active?

Accepted Answer

The VM has not been rescanned after the remediation was applied.. The alert remains active because Microsoft Defender for Cloud relies on periodic vulnerability scans to update the security findings. Remediating the vulnerability on the VM does not automatically trigger a rescan; the alert status is only updated after the next scheduled scan or a manual rescan is initiated. Until the VM is rescanned, Defender for Cloud continues to display the previous vulnerable state.

Answer

The alert is a false positive due to a known issue in the vulnerability assessment engine.

Answer

The alert has a 30-day retention period and cannot be dismissed before that.

Answer

Silent Remediation was enabled, preventing the alert from being dismissed.

Question 13

A security engineer configures a Microsoft Sentinel analytics rule to detect anomalous sign-ins from unfamiliar locations. The rule uses the following KQL query: SigninLogs | where RiskLevelDuringSignIn == 'medium' or RiskLevelDuringSignIn == 'high' | summarize count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 1h). After enabling the rule, no alerts are generated even though the team expects many. What is the most likely cause?

Accepted Answer

The query groups by IP address and user, so true anomalies (new IPs) are not detected because they appear in separate groups.. The KQL query groups sign-in events by UserPrincipalName, IPAddress, and a 1-hour time bin. This means each unique combination of user and IP address is counted separately, so a user signing in from a new, unfamiliar IP address will create a new group rather than being flagged as an anomaly. The rule does not compare IP addresses against a baseline of familiar locations, which is why no alerts are generated despite expected anomalous sign-ins.

Answer

The analytics rule is disabled due to a pricing tier downgrade.

Answer

The rule's trigger threshold is set too high (e.g., 100 events).

Answer

The SigninLogs data connector is not properly configured and is ingesting data with a 24-hour delay.

Question 14

You need to ensure that all Azure storage accounts in your subscription are encrypted at rest using customer-managed keys (CMK). Which Azure Policy initiative should you assign to audit compliance?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark initiative includes the policy definition 'Storage accounts should use customer-managed key for encryption,' which audits whether storage accounts are configured with CMK. Assigning this initiative to your subscription enables continuous compliance evaluation against this requirement. The other benchmarks (NIST, ISO, CIS) do not natively include the specific CMK audit policy for Azure Storage.

Answer

NIST SP 800-53 Rev. 5

Answer

ISO 27001:2013

Answer

CIS Microsoft Azure Foundations Benchmark

Question 15

Your organization uses Microsoft Sentinel to monitor for ransomware attacks. You need to create a custom analytics rule that detects when a large number of files are encrypted within a short time window. Which KQL query should you use as the rule logic?

Accepted Answer

FileCreationEvents | where FileName endswith '.encrypted' | summarize count() by Computer, UserName, bin(TimeGenerated, 5m). It uses a `FileCreationEvents` table (representing file creation activity in Windows or Azure Monitor agent logs) and filters for files ending with `.encrypted`, a common extension used by ransomware. The query then summarizes the count per computer, user, and 5-minute time bin, which directly detects a large number of encrypted files in a short window—matching the detection requirement.

Answer

AzureActivity | where OperationName contains 'encrypt' | summarize count() by Resource

Answer

SecurityEvent | where EventID == 4688 | summarize count() by Computer, bin(TimeGenerated, 5m)

Answer

CommonSecurityLog | where DeviceEventClassID == 'ransomware' | summarize count() by DeviceName