AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions have the 'Auto-provisioning' extension enabled for Log Analytics agent on new VMs. What should you configure?

Accepted Answer

Enable 'Auto-provisioning' in Defender for Cloud's environment settings.. Option A is correct because Auto-provisioning settings in Defender for Cloud allow you to automatically deploy the Log Analytics agent to new VMs. Option B is wrong because Azure Policy can be used but is not the direct setting for auto-provisioning in Defender for Cloud. Option C is wrong because Azure Automation State Configuration is not used for this purpose. Option D is wrong because Microsoft Sentinel is a SIEM, not a configuration tool for agent deployment.

Answer

Configure Azure Automation State Configuration to push the agent.

Answer

Set up data connectors in Microsoft Sentinel.

Answer

Create an Azure Policy assignment to deploy the Log Analytics agent.

Question 2

Your company has a hybrid environment with on-premises servers and Azure VMs. All resources are onboarded to Microsoft Defender for Cloud. You need to receive alerts when a critical vulnerability is detected on any server. The security team wants to minimize false positives. What should you configure?

Accepted Answer

Enable vulnerability assessment for servers via the integrated VA solution.. Option B is correct because vulnerability assessment (VA) solutions, like the integrated Qualys or Microsoft Defender Vulnerability Management, scan for known vulnerabilities and generate alerts. Option A is wrong because adaptive application controls are for whitelisting applications, not vulnerability detection. Option C is wrong because just-in-time (JIT) VM access is for managing RDP/SSH access. Option D is wrong because file integrity monitoring (FIM) monitors file changes, not vulnerabilities.

Answer

Configure just-in-time VM access to reduce attack surface.

Answer

Enable adaptive application controls to detect unapproved software.

Answer

Enable file integrity monitoring on critical files.

Question 3

A security analyst reports that Microsoft Sentinel is not receiving Windows Security Events from Azure VMs that have the Log Analytics agent installed. The agent shows as connected, and other data sources (e.g., performance counters) are flowing. What is the most likely cause?

Accepted Answer

The Windows Security Events connector is not configured to collect the required event IDs.. Option D is correct because the Windows Security Events connector in Sentinel requires specific event IDs to be collected; if the data collection rule or agent configuration does not include the required event IDs, the events won't be sent. Option A is wrong because the Log Analytics workspace key or certificate issue would affect all data, not just security events. Option B is wrong because if the agent is connected, network connectivity is fine. Option C is wrong because the Microsoft Sentinel solution is installed at the workspace level, not per VM.

Answer

The Microsoft Sentinel solution is not installed on the VM.

Answer

The Azure VM has a network security group blocking port 443.

Answer

The Log Analytics workspace key is incorrect.

Question 4

Your organization uses Microsoft Defender for Cloud to assess regulatory compliance. You need to ensure that the compliance dashboard reflects the latest standards and that custom assessments are included. What should you do?

Accepted Answer

Add a custom regulatory compliance standard in Defender for Cloud.. Option C is correct because the regulatory compliance dashboard in Defender for Cloud allows you to add custom initiatives and standards, including custom assessments. Option A is wrong because Azure Blueprints are deprecated and not the correct tool. Option B is wrong because Azure Policy alone does not integrate with the compliance dashboard. Option D is wrong because Microsoft Purview compliance portal is for data governance, not cloud security compliance assessment.

Answer

Configure Microsoft Purview compliance portal to include Azure subscriptions.

Answer

Use Azure Policy to apply custom definitions and assign to management groups.

Answer

Create an Azure Blueprint with custom policies.

Question 5

You are investigating a security incident in Microsoft Sentinel. A KQL query returns results indicating that a user logged in from an IP address that is not in the organization's approved list. The user's account has been compromised. You need to automatically disable the user account in Microsoft Entra ID when such an alert is triggered. What should you configure?

Accepted Answer

Create a playbook in Microsoft Sentinel with a Logic Apps connector to Microsoft Entra ID.. Option D is correct because Microsoft Sentinel can use automation rules with playbooks (based on Azure Logic Apps) to trigger actions like disabling a user in Microsoft Entra ID. Option A is wrong because Azure Policy cannot disable user accounts. Option B is wrong because Microsoft Defender for Cloud does not manage Entra ID user accounts. Option C is wrong because Power Automate is not natively integrated with Sentinel for this purpose.

Answer

Configure an Azure Policy that disables the user account.

Answer

Use Microsoft Defender for Cloud to automatically disable the account.

Answer

Create a Power Automate flow triggered by the Sentinel alert.

Question 6

Your organization is using Microsoft Defender for Cloud to protect Azure SQL databases. You need to enable Advanced Threat Protection (ATP) for all existing and future Azure SQL databases in a subscription. The solution must minimize administrative effort. What should you do?

Accepted Answer

Enable the Azure SQL databases plan in Microsoft Defender for Cloud at the subscription level.. Option B is correct because enabling Defender for Cloud at the subscription level with the SQL servers on machines plan (or Azure SQL databases plan) will automatically enable ATP for all supported resources, including future ones. Option A is wrong because enabling per database is not scalable. Option C is wrong because Azure Policy can be used but is not the most efficient direct method. Option D is wrong because Microsoft Sentinel is not for enabling ATP.

Answer

Configure Microsoft Sentinel to monitor Azure SQL databases.

Answer

Create an Azure Policy to deploy Advanced Threat Protection on Azure SQL databases.

Answer

Enable Advanced Threat Protection on each Azure SQL database individually.

Question 7

Your company has multiple Azure subscriptions. You need to centralize security alerts and incidents in a single dashboard for the security operations center (SOC) team. The solution should provide advanced analytics and threat detection. Which service should you use?

Accepted Answer

Microsoft Sentinel. Option C is correct because Microsoft Sentinel is a cloud-native SIEM and SOAR solution that centralizes security data and provides advanced analytics. Option A is wrong because Azure Monitor is for monitoring, not SIEM. Option B is wrong because Microsoft Defender for Cloud provides security posture management and threat detection but does not centralize alerts from multiple sources as a SIEM. Option D is wrong because Microsoft 365 Defender is for Microsoft 365 security, not multi-subscription Azure alerts.

Answer

Azure Monitor

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Cloud

Question 8

You are configuring Microsoft Defender for Cloud's continuous export feature. You need to export security alerts and recommendations to a Log Analytics workspace for long-term retention and custom analysis. The export should include only high-severity alerts and recommendations. What should you do?

Accepted Answer

Enable continuous export in Defender for Cloud and select high-severity alerts and recommendations.. Option C is correct because continuous export allows you to export alerts and recommendations to a Log Analytics workspace, and you can filter by severity using the export settings. Option A is wrong because diagnostic settings on individual resources would be inefficient and not filter by severity globally. Option B is wrong because Azure Event Hubs is for streaming, not Log Analytics. Option D is wrong because Microsoft Sentinel is not needed for this export.

Answer

Set up Microsoft Sentinel to ingest Defender for Cloud alerts and then export to the workspace.

Answer

Configure diagnostic settings on each Azure resource to send logs to the workspace.

Answer

Use Azure Event Hubs to stream security alerts to the workspace.

Question 9

You are reviewing the Azure Policy definition shown in the exhibit. This policy is assigned to a subscription. Several VMs are non-compliant. What is the most likely reason for the non-compliance?

Accepted Answer

The VMs do not have the Azure Disk Encryption extension installed.. Option C is correct because the policy audits if Azure Disk Encryption is not enabled on VMs without encryption settings. The condition checks if encryptionSettings does not exist, and then expects the AzureDiskEncryption extension. If the extension is missing, the VM is non-compliant. Option A is wrong because the policy does not check for Windows patch status. Option B is wrong because the policy does not check for encryption at host. Option D is wrong because the policy is about disk encryption, not backup.

Answer

The VMs are not backed up to Azure Backup.

Answer

The VMs have encryption at host enabled but not Azure Disk Encryption.

Answer

The VMs are missing critical Windows security patches.

Question 10

Your organization uses Microsoft Defender for Cloud to monitor Azure resources. You need to ensure that security recommendations are automatically remediated for non-compliant resources. Which TWO options can you use to achieve this?

Accepted Answer

Assign an Azure Policy with a DeployIfNotExists effect that deploys the required configuration.. Option A and B are correct. Quick Fix! remediation can be enabled for recommendations that support it, allowing automatic remediation when the recommendation is triggered. Azure Policy with DeployIfNotExists effect can also automatically remediate non-compliant resources by deploying required configurations. Option C is wrong because Logic Apps playbooks are for manual or scheduled remediation, not automatic. Option D is wrong because Azure Automation runbooks can be used but require custom setup and are not automatic by default. Option E is wrong because Microsoft Sentinel is for SIEM, not automatic remediation.

Answer

Create a Logic Apps playbook that runs on a schedule.

Answer

Configure Microsoft Sentinel to automatically remediate based on alerts.

Answer

Use Azure Automation runbooks to manually run remediation.

Question 11

You are designing a Microsoft Sentinel deployment for a multinational company. The company requires that all security logs be retained for at least seven years for compliance. The solution must be cost-effective. Which THREE actions should you take?

Accepted Answer

Configure the Log Analytics workspace retention to two years for interactive queries.. Option A, B, and E are correct. Enabling sentinel in the Log Analytics workspace allows interactive retention of up to two years. After that, you can set up Azure Blob Storage or Azure Data Lake Storage for long-term retention at lower cost. You can also use Azure Archive Storage for even cheaper storage. Option C is wrong because continuous export to Event Hubs is for real-time streaming, not long-term retention. Option D is wrong because Azure SQL Database is expensive for log storage and not designed for this purpose.

Answer

Use continuous export to Azure Event Hubs for long-term storage.

Answer

Store logs in Azure SQL Database for seven years.

Question 12

Your company uses Microsoft Defender for Cloud to protect Azure resources. You need to enable the enhanced security features (formerly Azure Defender) for all supported resource types. Which TWO plans should you enable? (Choose TWO that apply.)

Accepted Answer

Servers. Option A and D are correct. The 'Servers' plan covers Azure VMs and on-premises servers. The 'Cloud Security Posture Management (CSPM)' plan is the foundational plan that includes secure score, recommendations, and compliance. Option B is wrong because 'Azure Active Directory' is not a separate plan within Defender for Cloud; identity protection is covered by Microsoft Defender for Identity. Option C is wrong because 'Microsoft Sentinel' is a separate service. Option E is wrong because 'Microsoft 365 Defender' is a separate product.

Answer

Azure Active Directory

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Question 13

You execute the KQL query shown in the exhibit in Microsoft Sentinel. The query returns no results, but you know there have been high-severity malware alerts in the past week. What is the most likely issue?

Accepted Answer

The alert name is case-sensitive and does not exactly match 'Malware'.. Option D is correct because the query filters on AlertName containing "Malware" (case-sensitive). If the actual alert name uses a different case, like "malware" or "MalwareDetected", it might not match. Option A is wrong because if there were no alerts, other filters would also return empty. Option B is wrong because the data source is different; SecurityAlert table contains alerts from various sources. Option C is wrong because the time range is valid.

Answer

The SecurityAlert table does not contain malware alerts.

Answer

The time range filter is incorrect.

Answer

There are no high-severity alerts in the past week.

Question 14

You run the PowerShell command shown in the exhibit. After execution, you check the Log Analytics workspace in the Azure portal. The workspace is created successfully. However, when you try to onboard the workspace to Microsoft Sentinel, you receive an error that Sentinel cannot be enabled on this workspace. What is the most likely cause?

Accepted Answer

The workspace is in a region that does not support Microsoft Sentinel.. Option C is correct because Sentinel requires the Log Analytics workspace to be on a Pay-as-you-go (PerGB2018) pricing tier, but it also requires the workspace to be in a supported region. If the region is not supported, Sentinel cannot be enabled. Option A is wrong because the retention is set to 365 days, which is fine. Option B is wrong because the PerGB2018 tier is correct. Option D is wrong because resource group location does not affect Sentinel enablement.

Answer

The SKU is set to PerGB2018, which is not compatible with Sentinel.

Answer

The resource group location is different from the workspace location.

Answer

The retention period is set to 365 days, which exceeds the maximum for Sentinel.

Question 15

You deploy the Bicep template shown in the exhibit. After deployment, you check Microsoft Sentinel and find it is not enabled. The Log Analytics workspace and Defender for Cloud pricing plan are created successfully. What is the most likely reason Sentinel is not enabled?

Accepted Answer

The sentinel resource does not reference the workspace, so it is not linked.. Option D is correct because the sentinel resource (onboardingStates) is defined but it is not linked to the workspace resource. In Bicep, you need to create a dependency or reference the workspace ID to link Sentinel to that workspace. Without a dependency, the resources are deployed but Sentinel is not onboarded to the workspace. Option A is wrong because the pricing tier is Standard, which is correct. Option B is wrong because the SKU is PerGB2018, which is correct. Option C is wrong because retention is 90 days, which is allowed.

Answer

The Defender for Cloud pricing tier is set to 'Standard' but should be 'Free' for Sentinel.

Answer

The workspace retention is set to 90 days, but Sentinel requires at least 180 days.

Answer

The Log Analytics workspace SKU is set to 'PerGB2018' but Sentinel requires 'PerNode'.