AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 3 — 15 Questions

Question 1

A security administrator needs to enable just-in-time (JIT) VM access for all Azure VMs in a subscription using Microsoft Defender for Cloud. What are the minimum permissions required to enable JIT on the VMs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security Admin on the subscription. The Security Admin role in Microsoft Defender for Cloud includes the specific permission to manage just-in-time (JIT) VM access policies, which is a subset of security policy management. This role allows the administrator to enable, configure, and manage JIT on VMs without granting broader management rights like Contributor or Owner. The Security Admin role is the minimum privileged role that includes the 'Microsoft.Security/justInTimePolicies/write' action required to enable JIT.

Answer

Contributor on the subscription

Answer

Reader on the subscription

Answer

Owner on the subscription

Question 2

Your company uses Microsoft Defender for Cloud's regulatory compliance dashboard to track compliance with PCI DSS. After assigning the PCI DSS v4.0 initiative, several controls show as 'Not started' even though your resources are compliant. What is the most likely cause?

Accepted Answer

The PCI DSS initiative has not been assigned to the subscription.. The most likely cause of controls showing as 'Not started' is that the PCI DSS v4.0 initiative has not been assigned to the subscription. In Defender for Cloud, regulatory compliance initiatives must be explicitly assigned at the subscription or management group level; without assignment, the dashboard cannot evaluate resources against the initiative's controls, leaving them in a 'Not started' state even if the resources are technically compliant.

Answer

The regulatory compliance dashboard does not support custom initiatives.

Answer

The PCI DSS initiative is built-in and cannot be assigned manually.

Answer

The subscription is on the Free tier of Defender for Cloud.

Question 3

Which THREE are valid data connectors in Microsoft Sentinel? (Choose three.)

Accepted Answer

Amazon Web Services (AWS). Amazon Web Services (AWS) is a valid data connector in Microsoft Sentinel because Sentinel supports ingesting logs from AWS CloudTrail via the AWS S3 connector. This allows security events from AWS environments to be collected, normalized, and analyzed alongside Azure-native data, enabling multi-cloud threat detection and investigation.

Answer

Microsoft Defender for Cloud

Answer

Azure Firewall Manager

Question 4

Which TWO features are available in Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) capabilities? (Choose two.)

Accepted Answer

Attack path analysis. Attack path analysis is a CSPM capability in Microsoft Defender for Cloud that identifies the most likely sequences of actions an attacker could take to breach critical resources. It uses a graph-based model of your cloud environment to map dependencies and misconfigurations, enabling proactive risk mitigation. This is a core part of the Cloud Security Posture Management (CSPM) pillar, not a workload protection feature.

Answer

Just-in-time VM access

Answer

User and Entity Behavior Analytics (UEBA)

Answer

Vulnerability assessment for VMs

Question 5

Refer to the exhibit. You assign this Azure Policy definition to a subscription containing a storage account that uses Microsoft-managed keys. What is the compliance state of the storage account?

Accepted Answer

Non-compliant. The Azure Policy definition uses the 'audit' effect, which evaluates the storage account's configuration. Since the storage account uses Microsoft-managed keys and the policy likely requires customer-managed keys (CMK) for compliance, the storage account is non-compliant. The 'audit' effect logs the non-compliance without blocking the resource, resulting in a non-compliant state.

Answer

Compliant

Answer

Not evaluated because the policy is not assigned

Answer

Error: Policy effect 'audit' not supported

Question 6

Refer to the exhibit. You assign this policy to a subscription that already has a security contact configured with email 'admin@contoso.com'. What will be the outcome?

Accepted Answer

The policy will not modify the existing security contact because it already exists.. The Azure Policy definition shown uses the 'DeployIfNotExists' effect, which only deploys a resource (in this case, a security contact) if it does not already exist. Since the subscription already has a security contact configured with email 'admin@contoso.com', the policy will detect its presence and skip the deployment, leaving the existing contact unchanged. This behavior is by design to avoid overwriting existing configurations that may have been set manually or by other processes.

Answer

The policy will fail because the security contact already exists.

Answer

The subscription will become non-compliant because the email does not match.

Answer

The policy will overwrite the existing security contact with the one in the policy.

Question 7

Refer to the exhibit. A Microsoft Sentinel analytics rule uses this KQL query. What is the primary purpose of this rule?

Accepted Answer

Detect users with multiple risky sign-ins from non-US countries.. The KQL query filters sign-ins with risk level 'medium' or 'high' from countries other than the US, then counts them per user and filters for users with more than one such sign-in. This directly detects users who have multiple risky sign-ins from non-US countries, making option B correct. The rule does not consider historical sign-in patterns or averages, only the count of risky sign-ins outside the US.

Answer

Detect users who have never signed in from the US before.

Answer

Detect impossible travel patterns between the US and other countries.

Answer

Detect users whose sign-in count is higher than the average for their region.

Question 8

Your company, Contoso Ltd., has a hybrid environment with 500 on-premises Windows servers and 200 Azure VMs. The Azure VMs are spread across multiple subscriptions. You need to implement a centralized security monitoring solution using Microsoft Sentinel. The requirements are:
- Collect security events from all on-premises servers.
- Collect Azure activity logs and VM logs from all Azure subscriptions.
- Detect and respond to threats using built-in and custom analytics.
- Automatically remediate common threats such as disabling compromised user accounts.
- Ensure compliance with regulatory standards (e.g., NIST 800-53).
- Minimize administrative overhead and cost.

What should you do?

Accepted Answer

Deploy Azure Arc on all on-premises servers. Use Azure Monitor Agent with Data Collection Rules to collect security events. Enable Microsoft Sentinel on a Log Analytics workspace. Configure analytics rules and automation rules with playbooks for remediation.. It fully meets all requirements. Deploying Azure Arc on on-premises servers enables centralized management and allows the use of Azure Monitor Agent (AMA) with Data Collection Rules (DCRs) to collect security events efficiently. Enabling Microsoft Sentinel on a Log Analytics workspace provides built-in and custom analytics for threat detection. Automation rules with playbooks (Azure Logic Apps) enable automated remediation of common threats, such as disabling compromised accounts. This approach minimizes administrative overhead by using modern agent and DCRs, and it supports compliance standards like NIST 800-53. Option A is wrong because the Microsoft Monitoring Agent (MMA) is deprecated and does not support DCRs, making log collection less efficient; also, Azure Automation runbooks are more complex to manage compared to Sentinel playbooks. Option B is wrong because it does not implement Microsoft Sentinel and relies on a third-party SIEM, which adds cost and complexity without providing Sentinel's native analytics. Option C is wrong because the Sentinel Free tier severely limits data ingestion and lacks automation capabilities, failing to meet the automated remediation and compliance requirements.

Answer

Install Microsoft Monitoring Agent on on-premises servers and connect to a Log Analytics workspace. Enable Sentinel. Use Azure Automation runbooks for remediation.

Answer

Enable Microsoft Defender for Cloud on all subscriptions and install Defender for Endpoint on all servers. Forward logs to a third-party SIEM.

Answer

Create a Log Analytics workspace and enable Sentinel on the Free tier. Use KQL queries for detection and manual remediation.

Question 9

Which THREE are valid ways to ingest data into Microsoft Sentinel? (Choose three.)

Accepted Answer

Using the Azure Activity Log connector to stream subscription-level events.. The Azure Activity Log connector is a built-in data connector in Microsoft Sentinel that streams subscription-level events from the Azure Activity Log into Sentinel. This connector uses the Azure Monitor diagnostic settings to continuously export operational data, such as resource creation, deletion, and policy violations, enabling security monitoring and incident correlation without manual intervention.

Answer

Uploading a CSV file manually via the Azure portal.

Answer

Using Azure Policy to assign initiatives that send compliance data to Sentinel.

Question 10

You need to ensure that Microsoft Defender for Cloud automatically provisions the Log Analytics agent (AMA) on all new Azure VMs in a subscription. What should you configure?

Accepted Answer

Enable auto-provisioning in the Defender for Cloud environment settings.. Defender for Cloud's auto-provisioning setting, when enabled, automatically installs the Log Analytics agent (AMA) on all existing and new Azure VMs in the subscription. This is the native mechanism designed to ensure agent deployment without manual intervention or additional policy overhead.

Answer

Use Azure Automation State Configuration to enforce agent installation.

Answer

Install the Log Analytics agent as a VM extension on each VM manually.

Answer

Create an Azure Policy initiative that deploys the Log Analytics agent.

Question 11

Your company uses Microsoft Defender for Cloud to secure its Azure resources. The security team receives alerts about a potential brute-force attack on a Linux virtual machine. You need to verify whether the attack was successful and take immediate remediation actions. Which two Defender for Cloud features should you use together?

Accepted Answer

Enable Just-in-Time (JIT) VM access for the affected VM. Just-in-Time (JIT) VM access is the most appropriate feature because it immediately locks down inbound traffic to the VM, blocking further unauthorized access attempts. This directly addresses the requirement for immediate remediation. While File Integrity Monitoring (FIM) can help verify a successful breach by detecting changes to system files, it does not provide remediation. Therefore, JIT is the single best answer for the immediate action needed.

Answer

Configure adaptive application controls to whitelist allowed applications

Answer

Enable vulnerability assessment and review the findings

Answer

Enable Azure DDoS Protection on the virtual network

Answer

Use File Integrity Monitoring (FIM) to check for changes to system files

Question 12

Your organization has multiple Azure subscriptions managed by Microsoft Defender for Cloud. You need to ensure that all subscriptions have the same security policies applied, and that any new subscription automatically inherits these policies. What should you do?

Accepted Answer

Assign a policy initiative at the management group level. Assigning a policy initiative at the management group level ensures that all subscriptions within that management group inherit the same security policies. When a new subscription is added to the management group, it automatically receives the assigned initiative, meeting the requirement for consistent and automatic inheritance. This is the most efficient and scalable approach for managing multiple subscriptions in Microsoft Defender for Cloud.

Answer

Create an Azure Blueprint and assign it to each subscription

Answer

Assign a policy initiative to a resource group and then move subscriptions into that group

Answer

Assign a policy initiative to each subscription individually

Question 13

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). You need to collect sign-in logs and audit logs. Which data connector should you enable?

Accepted Answer

Azure Active Directory (now Microsoft Entra ID). The Azure Active Directory (now Microsoft Entra ID) data connector is the correct choice because it is specifically designed to ingest both sign-in logs and audit logs from Microsoft Entra ID into Microsoft Sentinel. This connector enables the collection of user sign-in activities and directory audit events, which are essential for security monitoring and incident detection.

Answer

Azure AD Identity Protection

Answer

Office 365

Answer

Azure AD Authentication

Question 14

Your company uses Microsoft Defender for Cloud to protect Azure resources. You notice that some Azure VMs are not showing any security recommendations. You verify that the VMs are running and have network connectivity. What is the most likely cause?

Accepted Answer

The Log Analytics agent is not installed on the VMs. Microsoft Defender for Cloud relies on the Log Analytics agent (or Azure Monitor Agent) to collect security-relevant data from Azure VMs, such as configuration settings, event logs, and vulnerability signals. Without this agent installed, Defender for Cloud cannot assess the VM's security posture, and therefore no security recommendations will be generated for that VM, even if the VM is running and has network connectivity.

Answer

The VMs are in a resource group that lacks the required Azure RBAC role

Answer

The VMs have a resource lock preventing policy evaluation

Answer

The VMs are in the Free tier of Defender for Cloud

Question 15

You are investigating a security incident in Microsoft Sentinel. The incident involves multiple alerts from different data sources. You need to correlate the alerts to determine the full attack chain. Which Microsoft Sentinel feature should you use?

Accepted Answer

Incident investigation. Incident investigation in Microsoft Sentinel is designed specifically for visualizing and correlating alerts within an incident to reconstruct the full attack chain. It provides a graphical map that links entities (e.g., IP addresses, user accounts, hosts) across alerts from different data sources, enabling you to trace the attacker's path step by step.

Answer

Analytics rules

Answer

Playbooks

Answer

Workbooks