AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 2 — 15 Questions

Question 1

You deploy the Bicep template shown in the exhibit. After deployment, you check Microsoft Sentinel and find it is not enabled. The Log Analytics workspace and Defender for Cloud pricing plan are created successfully. What is the most likely reason Sentinel is not enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The sentinel resource does not reference the workspace, so it is not linked.. Microsoft Sentinel requires an explicit resource definition that references the Log Analytics workspace via the `workspaceId` property. Without this linkage, the Sentinel resource is not connected to the workspace, and Sentinel remains disabled even if the workspace and Defender for Cloud pricing plan are deployed successfully.

Answer

The Defender for Cloud pricing tier is set to 'Standard' but should be 'Free' for Sentinel.

Answer

The workspace retention is set to 90 days, but Sentinel requires at least 180 days.

Answer

The Log Analytics workspace SKU is set to 'PerGB2018' but Sentinel requires 'PerNode'.

Question 2

A security engineer configures a Microsoft Sentinel analytics rule to detect anomalous sign-ins from unfamiliar locations. The rule uses the following KQL query: SigninLogs | where RiskLevelDuringSignIn == 'medium' or RiskLevelDuringSignIn == 'high' | summarize count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 1h). After enabling the rule, no alerts are generated even though the team expects many. What is the most likely cause?

Accepted Answer

The query groups by IP address and user, so true anomalies (new IPs) are not detected because they appear in separate groups.. The KQL query groups sign-in events by UserPrincipalName, IPAddress, and a 1-hour time bin. This means each unique combination of user and IP address is counted separately, so a user signing in from a new, unfamiliar IP address will create a new group rather than being flagged as an anomaly. The rule does not compare IP addresses against a baseline of familiar locations, which is why no alerts are generated despite expected anomalous sign-ins.

Answer

The analytics rule is disabled due to a pricing tier downgrade.

Answer

The rule's trigger threshold is set too high (e.g., 100 events).

Answer

The SigninLogs data connector is not properly configured and is ingesting data with a 24-hour delay.

Question 3

You need to ensure that all Azure storage accounts in your subscription are encrypted at rest using customer-managed keys (CMK). Which Azure Policy initiative should you assign to audit compliance?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark initiative includes the policy definition 'Storage accounts should use customer-managed key for encryption,' which audits whether storage accounts are configured with CMK. Assigning this initiative to your subscription enables continuous compliance evaluation against this requirement. The other benchmarks (NIST, ISO, CIS) do not natively include the specific CMK audit policy for Azure Storage.

Answer

NIST SP 800-53 Rev. 5

Answer

ISO 27001:2013

Answer

CIS Microsoft Azure Foundations Benchmark

Question 4

Your organization uses Microsoft Sentinel to monitor for ransomware attacks. You need to create a custom analytics rule that detects when a large number of files are encrypted within a short time window. Which KQL query should you use as the rule logic?

Accepted Answer

FileCreationEvents | where FileName endswith '.encrypted' | summarize count() by Computer, UserName, bin(TimeGenerated, 5m). It uses a `FileCreationEvents` table (representing file creation activity in Windows or Azure Monitor agent logs) and filters for files ending with `.encrypted`, a common extension used by ransomware. The query then summarizes the count per computer, user, and 5-minute time bin, which directly detects a large number of encrypted files in a short window—matching the detection requirement.

Answer

AzureActivity | where OperationName contains 'encrypt' | summarize count() by Resource

Answer

SecurityEvent | where EventID == 4688 | summarize count() by Computer, bin(TimeGenerated, 5m)

Answer

CommonSecurityLog | where DeviceEventClassID == 'ransomware' | summarize count() by DeviceName

Question 5

A security administrator needs to enable just-in-time (JIT) VM access for all Azure VMs in a subscription using Microsoft Defender for Cloud. What are the minimum permissions required to enable JIT on the VMs?

Accepted Answer

Security Admin on the subscription. The Security Admin role in Microsoft Defender for Cloud includes the specific permission to manage just-in-time (JIT) VM access policies, which is a subset of security policy management. This role allows the administrator to enable, configure, and manage JIT on VMs without granting broader management rights like Contributor or Owner. The Security Admin role is the minimum privileged role that includes the 'Microsoft.Security/justInTimePolicies/write' action required to enable JIT.

Answer

Contributor on the subscription

Answer

Reader on the subscription

Answer

Owner on the subscription

Question 6

Your company uses Microsoft Defender for Cloud's regulatory compliance dashboard to track compliance with PCI DSS. After assigning the PCI DSS v4.0 initiative, several controls show as 'Not started' even though your resources are compliant. What is the most likely cause?

Accepted Answer

The PCI DSS initiative has not been assigned to the subscription.. The most likely cause of controls showing as 'Not started' is that the PCI DSS v4.0 initiative has not been assigned to the subscription. In Defender for Cloud, regulatory compliance initiatives must be explicitly assigned at the subscription or management group level; without assignment, the dashboard cannot evaluate resources against the initiative's controls, leaving them in a 'Not started' state even if the resources are technically compliant.

Answer

The regulatory compliance dashboard does not support custom initiatives.

Answer

The PCI DSS initiative is built-in and cannot be assigned manually.

Answer

The subscription is on the Free tier of Defender for Cloud.

Question 7

Which TWO actions can be performed using Microsoft Defender for Cloud's security alerts? (Choose two.)

Accepted Answer

Create suppression rules to automatically dismiss alerts that meet specific criteria.. Microsoft Defender for Cloud allows you to create suppression rules that automatically dismiss alerts matching specific criteria, such as alert name, resource, or severity. This is useful for reducing noise from known benign activities without disabling the underlying security detection. Suppression rules are configured per alert type and can be set to expire after a defined period.

Answer

Directly modify the affected Azure resource's configuration from the alert.

Answer

Export alerts to a third-party SIEM using continuous export.

Answer

Change the severity of an alert after it is generated.

Question 8

Which THREE are valid data connectors in Microsoft Sentinel? (Choose three.)

Accepted Answer

Amazon Web Services (AWS). Option C (Amazon Web Services) is correct because Microsoft Sentinel provides a built-in AWS CloudTrail connector that ingests AWS account activity logs into the workspace via the AWS S3-based data connector. Option D (Microsoft Entra ID, now Microsoft Entra ID) is correct because the Microsoft Entra ID (Azure AD) connector streams sign-in logs, audit logs, and provisioning events into Sentinel through the Azure Monitor/Log Analytics pipeline. Option E (Syslog) is correct because Sentinel supports Syslog via the Log Analytics agent (AMA/MMA) using the Syslog data connector, typically over CEF or raw syslog from Linux/network devices. Option A (Microsoft Defender for Cloud) is not a standalone Sentinel data connector in this list because Defender for Cloud alerts flow through the Microsoft Defender for Cloud connector/Defender XDR integration rather than being a distinct Sentinel connector name here. Option B (Azure Firewall Manager) is not a Sentinel data connector; Azure Firewall logs are ingested via Azure Diagnostics/Log Analytics, not through a Firewall Manager connector.

Answer

Microsoft Defender for Cloud

Answer

Azure Firewall Manager

Question 9

Refer to the exhibit. You assign this Azure Policy definition to a subscription containing a storage account that uses Microsoft-managed keys. What is the compliance state of the storage account?

Accepted Answer

Non-compliant. The Azure Policy definition uses the 'audit' effect, which evaluates the storage account's configuration. Since the storage account uses Microsoft-managed keys and the policy likely requires customer-managed keys (CMK) for compliance, the storage account is non-compliant. The 'audit' effect logs the non-compliance without blocking the resource, resulting in a non-compliant state.

Answer

Compliant

Answer

Not evaluated because the policy is not assigned

Answer

Error: Policy effect 'audit' not supported

Question 10

Which THREE are valid ways to ingest data into Microsoft Sentinel? (Choose three.)

Accepted Answer

Using the Azure Activity Log connector to stream subscription-level events.. Option B is correct because the Azure Activity Log connector is a built-in Microsoft Sentinel data connector that streams subscription-level control-plane events (resource creation, deletion, policy changes) directly into the workspace via Azure Monitor. Option D is correct because the CEF connector (delivered through the Log Analytics agent/AMA and the CEF log forwarder) is the standard supported method for ingesting Common Event Format logs from third-party security appliances such as firewalls, proxies, and IDS/IPS. Option E is correct because the Syslog connector, also using the Log Analytics agent/AMA on a Linux forwarder, ingests RFC 3164/5424 Syslog messages from on-premises firewalls and other network devices. Option A is not a valid ingestion method — Microsoft Sentinel does not support manually uploading CSV files through the Azure portal; data arrives through connectors, the Logs Ingestion API, or custom log tables. Option C is not a valid ingestion path — Azure Policy is used for governance and compliance assessment, and while compliance data can be surfaced in Azure, assigning initiatives does not itself send data into a Microsoft Sentinel workspace.

Answer

Uploading a CSV file manually via the Azure portal.

Answer

Using Azure Policy to assign initiatives that send compliance data to Sentinel.

Question 11

You need to ensure that Microsoft Defender for Cloud automatically provisions the Log Analytics agent (AMA) on all new Azure VMs in a subscription. What should you configure?

Accepted Answer

Enable auto-provisioning in the Defender for Cloud environment settings.. Defender for Cloud's auto-provisioning setting, when enabled, automatically installs the Log Analytics agent (AMA) on all existing and new Azure VMs in the subscription. This is the native mechanism designed to ensure agent deployment without manual intervention or additional policy overhead.

Answer

Use Azure Automation State Configuration to enforce agent installation.

Answer

Install the Log Analytics agent as a VM extension on each VM manually.

Answer

Create an Azure Policy initiative that deploys the Log Analytics agent.

Question 12

Your company uses Microsoft Defender for Cloud to secure its Azure resources. The security team receives alerts about a potential brute-force attack on a Linux virtual machine. You need to verify whether the attack was successful and take immediate remediation actions. Which two Defender for Cloud features should you use together?

Accepted Answer

Enable Just-in-Time (JIT) VM access for the affected VM. Just-in-Time (JIT) VM access is the most appropriate feature because it immediately locks down inbound traffic to the VM, blocking further unauthorized access attempts. This directly addresses the requirement for immediate remediation. While File Integrity Monitoring (FIM) can help verify a successful breach by detecting changes to system files, it does not provide remediation. Therefore, JIT is the single best answer for the immediate action needed.

Answer

Configure adaptive application controls to whitelist allowed applications

Answer

Enable vulnerability assessment and review the findings

Answer

Enable Azure DDoS Protection on the virtual network

Answer

Use File Integrity Monitoring (FIM) to check for changes to system files

Question 13

Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all Azure SQL databases have Advanced Data Security enabled. What should you do?

Accepted Answer

Create an Azure Policy to enforce Advanced Data Security. Azure Policy can be used to enforce Advanced Data Security (ADS) at scale across all Azure SQL databases in a subscription or management group. By creating a policy that requires ADS to be enabled, any non-compliant database is automatically flagged or remediated, ensuring consistent security posture without manual intervention. This aligns with the principle of using policy-driven governance to enforce security controls across Azure resources.

Answer

Enable Advanced Data Security on each database manually

Answer

Use the Azure Security Center dashboard to enable it for all databases

Answer

Configure the Azure SQL Firewall to allow only secure connections

Question 14

Refer to the exhibit. You are reviewing an Azure Policy initiative definition in Microsoft Defender for Cloud. The initiative includes a policy definition with reference ID 'CIS-1.1'. The policy definition ID is '/providers/Microsoft.Authorization/policyDefinitions/abc123'. You need to verify that the policy definition exists and is correctly assigned. Which Azure CLI command should you run?

Accepted Answer

az policy definition show --id /providers/Microsoft.Authorization/policyDefinitions/abc123. The `az policy definition show --id` command retrieves the details of a specific policy definition by its full resource ID. Since the question asks to verify that the policy definition with ID '/providers/Microsoft.Authorization/policyDefinitions/abc123' exists and is correctly assigned, this command directly confirms its existence and properties without filtering through a list.

Answer

az policy assignment list --query "[?policyDefinitionId=='/providers/Microsoft.Authorization/policyDefinitions/abc123']"

Answer

az policy set-definition show --name "CIS Benchmark v1.1.0"

Answer

az policy definition list --query "[?id=='/providers/Microsoft.Authorization/policyDefinitions/abc123']"

Question 15

Your organization uses Microsoft Sentinel to manage security incidents. You need to configure automated response to block a user account when a high-severity incident is triggered. The response should be automatically executed when the incident is created. What should you create?

Accepted Answer

An automation rule that triggers a playbook. Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created, including running a playbook to block a user account. This directly meets the requirement for an automatic response upon incident creation without manual intervention.

Answer

An analytics rule

Answer

A playbook

Answer

A workbook