AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 3 — 15 Questions

Question 1

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. The security team receives an alert about a critical vulnerability in an Azure VM that was remediated two weeks ago. What is the most likely reason the alert is still active?

Accepted Answer

The VM has not been rescanned after the remediation was applied.. Option C is correct because Defender for Cloud alerts are based on the latest vulnerability assessment scans; if the VM hasn't been rescanned since remediation, the alert remains. Option A is wrong because default policies don't suppress alerts. Option B is wrong because Silent Remediation suppresses alerts after remediation. Option D is wrong because alerts are not automatically dismissed after a time period.

Answer

The alert is a false positive due to a known issue in the vulnerability assessment engine.

Answer

The alert has a 30-day retention period and cannot be dismissed before that.

Answer

Silent Remediation was enabled, preventing the alert from being dismissed.

Question 2

A security engineer configures a Microsoft Sentinel analytics rule to detect anomalous sign-ins from unfamiliar locations. The rule uses the following KQL query: SigninLogs | where RiskLevelDuringSignIn == 'medium' or RiskLevelDuringSignIn == 'high' | summarize count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 1h). After enabling the rule, no alerts are generated even though the team expects many. What is the most likely cause?

Accepted Answer

The query groups by IP address and user, so true anomalies (new IPs) are not detected because they appear in separate groups.. Option B is correct because the query groups by UserPrincipalName, IPAddress, and hour; if the same user signs in from the same IP within the same hour, it's not anomalous. Option A is wrong because the rule is enabled. Option C is wrong because no aggregation threshold is set. Option D is wrong because the data connector might be slow but would still generate some alerts.

Answer

The analytics rule is disabled due to a pricing tier downgrade.

Answer

The rule's trigger threshold is set too high (e.g., 100 events).

Answer

The SigninLogs data connector is not properly configured and is ingesting data with a 24-hour delay.

Question 3

You need to ensure that all Azure storage accounts in your subscription are encrypted at rest using customer-managed keys (CMK). Which Azure Policy initiative should you assign to audit compliance?

Accepted Answer

Azure Security Benchmark. Option A is correct because Azure Security Benchmark includes a policy to audit storage accounts for CMK encryption. Option B is wrong because ISO 27001 doesn't specifically cover CMK. Option C is wrong because NIST SP 800-53 doesn't have a direct CMK audit policy. Option D is wrong because CIS Microsoft Azure Foundations Benchmark has a different scope.

Answer

NIST SP 800-53 Rev. 5

Answer

ISO 27001:2013

Answer

CIS Microsoft Azure Foundations Benchmark

Question 4

Your organization uses Microsoft Sentinel to monitor for ransomware attacks. You need to create a custom analytics rule that detects when a large number of files are encrypted within a short time window. Which KQL query should you use as the rule logic?

Accepted Answer

FileCreationEvents | where FileName endswith '.encrypted' | summarize count() by Computer, UserName, bin(TimeGenerated, 5m). Option D is correct because FileCreationEvents can capture file encryption events, and the query groups by host and user to detect a spike. Option A is wrong because SecurityEvent doesn't include file creation details. Option B is wrong because CommonSecurityLog is for firewall logs. Option C is wrong because AzureActivity doesn't capture file-level operations.

Answer

AzureActivity | where OperationName contains 'encrypt' | summarize count() by Resource

Answer

SecurityEvent | where EventID == 4688 | summarize count() by Computer, bin(TimeGenerated, 5m)

Answer

CommonSecurityLog | where DeviceEventClassID == 'ransomware' | summarize count() by DeviceName

Question 5

A security administrator needs to enable just-in-time (JIT) VM access for all Azure VMs in a subscription using Microsoft Defender for Cloud. What are the minimum permissions required to enable JIT on the VMs?

Accepted Answer

Security Admin on the subscription. Option B is correct because the Security Admin role can manage security policies and enable JIT. Option A is wrong because Contributor can manage VMs but not security policies. Option C is wrong because Reader cannot make changes. Option D is wrong because Owner has more permissions than needed, but the question asks for minimum.

Answer

Contributor on the subscription

Answer

Reader on the subscription

Answer

Owner on the subscription

Question 6

Your company uses Microsoft Defender for Cloud's regulatory compliance dashboard to track compliance with PCI DSS. After assigning the PCI DSS v4.0 initiative, several controls show as 'Not started' even though your resources are compliant. What is the most likely cause?

Accepted Answer

The PCI DSS initiative has not been assigned to the subscription.. Option C is correct because the PCI DSS initiative includes policies that must be assigned and evaluated; if not assigned, controls show 'Not started'. Option A is wrong because the dashboard includes custom initiatives. Option B is wrong because pricing tier doesn't affect policy assignment. Option D is wrong because Azure Policy assigns initiatives, not Defender for Cloud directly.

Answer

The regulatory compliance dashboard does not support custom initiatives.

Answer

The PCI DSS initiative is built-in and cannot be assigned manually.

Answer

The subscription is on the Free tier of Defender for Cloud.

Question 7

Which TWO actions can be performed using Microsoft Defender for Cloud's security alerts? (Choose two.)

Accepted Answer

Create suppression rules to automatically dismiss alerts that meet specific criteria.. Options A and B are correct. Defender for Cloud alerts support suppression rules and automated response via playbooks. Option C is wrong because Defender for Cloud does not directly modify resources; it triggers actions via playbooks. Option D is wrong because alerts can be dismissed. Option E is wrong because alert severity is set by Defender for Cloud, not by users.

Answer

Directly modify the affected Azure resource's configuration from the alert.

Answer

Export alerts to a third-party SIEM using continuous export.

Answer

Change the severity of an alert after it is generated.

Question 8

Which THREE are valid data connectors in Microsoft Sentinel? (Choose three.)

Accepted Answer

Amazon Web Services (AWS). Amazon Web Services (AWS) is a valid data connector in Microsoft Sentinel because Sentinel supports ingesting logs from AWS CloudTrail via the AWS S3 connector. This allows security events from AWS environments to be collected, normalized, and analyzed alongside Azure-native data, enabling multi-cloud threat detection and investigation.

Answer

Microsoft Defender for Cloud

Answer

Azure Firewall Manager

Question 9

Which TWO features are available in Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) capabilities? (Choose two.)

Accepted Answer

Attack path analysis. Options A and D are correct. CSPM includes attack path analysis and security governance. Option B is wrong because vulnerability assessment is part of workload protection. Option C is wrong because JIT access is a workload protection feature. Option E is wrong because UEBA is part of Microsoft Sentinel or Defender for Identity.

Answer

Just-in-time VM access

Answer

User and Entity Behavior Analytics (UEBA)

Answer

Vulnerability assessment for VMs

Question 10

Refer to the exhibit. You assign this Azure Policy definition to a subscription containing a storage account that uses Microsoft-managed keys. What is the compliance state of the storage account?

Accepted Answer

Non-compliant. Option B is correct because the policy audits storage accounts that do not have keySource = Microsoft.Keyvault. Since the storage account uses Microsoft-managed keys (keySource = Microsoft.Storage), it is non-compliant. Option A is wrong because it is non-compliant. Option C is wrong because the policy is an audit effect, not deny. Option D is wrong because the policy is assigned and evaluated.

Answer

Compliant

Answer

Not evaluated because the policy is not assigned

Answer

Error: Policy effect 'audit' not supported

Question 11

Refer to the exhibit. You assign this policy to a subscription that already has a security contact configured with email 'admin@contoso.com'. What will be the outcome?

Accepted Answer

The policy will not modify the existing security contact because it already exists.. Option A is correct because the policy only deploys if no security contact exists with a non-empty email. Since a contact exists, the policy will not modify it. Option B is wrong because the policy uses deployIfNotExists with existence check. Option C is wrong because the policy won't fail. Option D is wrong because the policy is not evaluated as non-compliant.

Answer

The policy will fail because the security contact already exists.

Answer

The subscription will become non-compliant because the email does not match.

Answer

The policy will overwrite the existing security contact with the one in the policy.

Question 12

Refer to the exhibit. A Microsoft Sentinel analytics rule uses this KQL query. What is the primary purpose of this rule?

Accepted Answer

Detect users with multiple risky sign-ins from non-US countries.. Option B is correct because the query filters for risky sign-ins from countries other than the US, and then counts them per user; limiting to >3 detects users with multiple risky sign-ins from non-US countries. Option A is wrong because it doesn't compare to previous behavior. Option C is wrong because it doesn't compare to other users. Option D is wrong because it doesn't look for impossible travel.

Answer

Detect users who have never signed in from the US before.

Answer

Detect impossible travel patterns between the US and other countries.

Answer

Detect users whose sign-in count is higher than the average for their region.

Question 13

Your company, Contoso Ltd., has a hybrid environment with 500 on-premises Windows servers and 200 Azure VMs. The Azure VMs are spread across multiple subscriptions. You need to implement a centralized security monitoring solution using Microsoft Sentinel. The requirements are:
- Collect security events from all on-premises servers.
- Collect Azure activity logs and VM logs from all Azure subscriptions.
- Detect and respond to threats using built-in and custom analytics.
- Automatically remediate common threats such as disabling compromised user accounts.
- Ensure compliance with regulatory standards (e.g., NIST 800-53).
- Minimize administrative overhead and cost.

What should you do?

Accepted Answer

Deploy Azure Arc on all on-premises servers. Use Azure Monitor Agent with Data Collection Rules to collect security events. Enable Microsoft Sentinel on a Log Analytics workspace. Configure analytics rules and automation rules with playbooks for remediation.. Option A is correct because it meets all requirements: deploy Azure Arc agent for on-premises servers to enable Azure Monitor Agent, use DCRs to collect logs, enable Sentinel analytics, and use automation rules with playbooks for remediation. Option B is wrong because legacy MMA is deprecated and doesn't support DCRs; also, Azure Automation runbooks are more complex than playbooks. Option C is wrong because enabling Defender for Cloud on all subscriptions is expensive and doesn't provide the same analytics as Sentinel. Option D is wrong because the Sentinel Free tier has limited features and no automation.

Answer

Install Microsoft Monitoring Agent on on-premises servers and connect to a Log Analytics workspace. Enable Sentinel. Use Azure Automation runbooks for remediation.

Answer

Enable Microsoft Defender for Cloud on all subscriptions and install Defender for Endpoint on all servers. Forward logs to a third-party SIEM.

Answer

Create a Log Analytics workspace and enable Sentinel on the Free tier. Use KQL queries for detection and manual remediation.

Question 14

Which THREE are valid ways to ingest data into Microsoft Sentinel? (Choose three.)

Accepted Answer

Using the Azure Activity Log connector to stream subscription-level events.. Options A, B, and D are valid ingestion methods. Option C is wrong because Azure Policy is used for governance, not direct data ingestion. Option E is wrong because manual CSV upload is not a standard ingestion method; Sentinel uses connectors for structured data.

Answer

Uploading a CSV file manually via the Azure portal.

Answer

Using Azure Policy to assign initiatives that send compliance data to Sentinel.

Question 15

You need to ensure that Microsoft Defender for Cloud automatically provisions the Log Analytics agent (AMA) on all new Azure VMs in a subscription. What should you configure?

Accepted Answer

Enable auto-provisioning in the Defender for Cloud environment settings.. Option A is correct because Defender for Cloud has an auto-provisioning setting for the Log Analytics agent. Option B is wrong because Azure Policy can be used but is not the default mechanism. Option C is wrong because VM extensions can be installed manually but not automatically for all new VMs. Option D is wrong because Azure Automation is not designed for this purpose.

Answer

Use Azure Automation State Configuration to enforce agent installation.

Answer

Install the Log Analytics agent as a VM extension on each VM manually.

Answer

Create an Azure Policy initiative that deploys the Log Analytics agent.