AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 3 — 15 Questions

Question 1

Your security team detects a series of failed sign-ins from multiple IP addresses for a privileged user account in Microsoft Entra ID. You need to automatically create an incident in Microsoft Sentinel and block the user account. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure automated investigation and remediation in Microsoft Defender XDR. Microsoft Defender XDR's automated investigation and remediation (AIR) can be configured to automatically block a user account when a series of failed sign-ins from multiple IP addresses is detected. This capability leverages the unified incident and alert correlation across Defender for Identity, Defender for Cloud Apps, and Entra ID Protection to trigger a response action (e.g., disabling the user) without requiring a custom playbook or manual intervention.

Answer

Create a playbook in Microsoft Sentinel that triggers on the sign-in logs

Answer

Use Microsoft Entra ID Protection to automatically remediate risk

Answer

Set up a detection rule in Microsoft Sentinel that sends an email to security admins

Question 2

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to collect logs from on-premises Linux servers and send them to Sentinel. The solution must minimize latency and administrative overhead. What should you deploy?

Accepted Answer

Connect servers via Azure Arc and install the Azure Monitor Agent. Azure Arc bridges on-premises Linux servers to Azure, enabling the deployment of the Azure Monitor Agent (AMA) without requiring a direct internet connection or complex proxy configurations. The AMA uses a single, lightweight agent for both platform and custom logs, reducing latency by sending data directly to the Log Analytics workspace via HTTPS on port 443, and it minimizes administrative overhead through centralized management via data collection rules (DCRs). This approach is the recommended modern method for hybrid log collection in Microsoft Sentinel.

Answer

Use the Microsoft Monitoring Agent to send logs directly

Answer

Configure a syslog server to forward logs to the Log Analytics workspace

Answer

Install the Log Analytics agent on each server

Question 3

Your organization uses Microsoft Defender for Cloud to protect Azure VMs. You notice that some VMs are not reporting security data. You verify that the Log Analytics agent is installed and running. What is the most likely cause?

Accepted Answer

The VMs are using the legacy Log Analytics agent instead of the Azure Monitor Agent. The most likely cause is that the VMs are using the legacy Log Analytics agent (also known as the Microsoft Monitoring Agent or OMS agent) instead of the Azure Monitor Agent (AMA). Defender for Cloud requires the Azure Monitor Agent to report security data for features like vulnerability assessments, file integrity monitoring, and security alerts. The legacy agent does not support these advanced security data collection capabilities, even if it is installed and running.

Answer

Auto-provisioning is disabled for the subscription

Answer

The VMs are running an unsupported operating system

Answer

The VMs do not have network connectivity to the Log Analytics workspace

Question 4

Which TWO of the following are valid ways to integrate Microsoft Sentinel with Microsoft Defender XDR?

Accepted Answer

Configure the Microsoft Defender XDR data connector. The Microsoft Defender XDR data connector is the official and supported method to ingest alerts and incidents from Microsoft Defender XDR into Microsoft Sentinel. This connector enables bi-directional synchronization, allowing incidents created in Defender XDR to appear in Sentinel and vice versa, with automatic correlation and enrichment.

Answer

Use Azure Lighthouse to connect Defender XDR to Sentinel

Answer

Deploy a playbook that polls Defender XDR APIs

Answer

Create a custom log analytics workspace query

Question 5

Which TWO of the following are valid data connectors in Microsoft Sentinel?

Accepted Answer

Azure Active Directory (Microsoft Entra ID). Option D, Microsoft Entra ID (Microsoft Entra ID), is correct because Microsoft Sentinel provides a built-in data connector for Microsoft Entra ID that ingests sign-in logs, audit logs, and other identity events via the Azure Monitor Agent or the native connector in the Sentinel Content Hub. Option E, Amazon Web Services S3, is correct because Sentinel offers an AWS S3 connector (part of the AWS solution in Content Hub) that pulls CloudTrail and other AWS logs stored in S3 buckets into the workspace. Option A, Microsoft SQL Server, is not a native Sentinel data connector; database audit data would need to be forwarded via a custom log pipeline such as Logs Ingestion API or Azure Monitor. Option B, Google Cloud Platform, is not a native Sentinel connector; GCP logs require a custom or third-party integration. Option C, VMware vCenter, is also not a native Sentinel data connector and would need a custom collector or syslog forwarding.

Answer

Microsoft SQL Server

Answer

Google Cloud Platform

Answer

VMware vCenter

Question 6

You are a security engineer for a company that uses Microsoft Defender for Cloud with the CSPM (Cloud Security Posture Management) plan enabled. You need to ensure that all Azure subscriptions are assessed against the Microsoft Cloud Security Benchmark (MCSB). Which action should you take?

Accepted Answer

No action needed; MCSB is the default security policy assigned to all subscriptions.. When the CSPM plan is enabled in Microsoft Defender for Cloud, the Microsoft Cloud Security Benchmark (MCSB) is automatically assigned as the default security policy initiative to all Azure subscriptions. No manual assignment is required because MCSB replaces the former Azure Security Benchmark and is applied by default to every subscription that has the CSPM plan enabled. This ensures continuous assessment against MCSB controls without any additional configuration.

Answer

Assign the CIS Microsoft Azure Foundations Benchmark initiative to each subscription.

Answer

Assign the MCSB initiative at the management group level.

Answer

Enable regulatory compliance standards in Defender for Cloud.

Question 7

You are responsible for securing Azure resources using Microsoft Defender for Cloud. You receive a recommendation that your Azure Kubernetes Service (AKS) cluster has a vulnerability in a container image. The recommendation is labeled 'Container images should be scanned for vulnerabilities'. What action should you take to remediate this recommendation?

Accepted Answer

Rebuild the container image using an updated base image and redeploy.. The recommendation 'Container images should be scanned for vulnerabilities' indicates that a vulnerability has been found in a container image used by your AKS cluster. Remediation requires rebuilding the container image from an updated base image that includes security patches, then redeploying the updated image to the cluster. This directly addresses the root cause by eliminating the vulnerable components from the image.

Answer

Enable the 'Vulnerability assessment solutions should be enabled on your VMs' recommendation.

Answer

Enable Microsoft Defender for Cloud Apps for the AKS cluster.

Answer

Disable the vulnerability scanner for that repository.

Question 8

Which THREE of the following are capabilities of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) plan? (Select three.)

Accepted Answer

Continuous assessment of security configurations.. Option A is correct because Defender for Cloud's foundational CSPM continuously assesses cloud resources against security configurations and benchmarks, surfacing misconfigurations across Azure, AWS, and GCP. Option B is correct because CSPM provides the secure score, which quantifies posture, tracks improvement over time, and offers recommendations to raise the score. Option D is correct because CSPM recommendations are driven by the Microsoft Cloud Security Benchmark (MCSB), mapping controls to industry standards like CIS and PCI DSS. Option C is not a CSPM capability; just-in-time VM access is a workload protection feature of Microsoft Defender for Servers (Defender for Cloud's Defender for Servers plan) that opens NSG/防火墙 ports on demand. Option E is also not CSPM; File Integrity Monitoring is part of Microsoft Defender for Servers (via the Log Analytics/AMA agent and change tracking), used to detect changes to critical OS files and registry keys.

Answer

Just-in-time (JIT) VM access.

Answer

File Integrity Monitoring (FIM).

Question 9

Your security team uses Microsoft Sentinel to detect threats. You need to set up a rule that triggers an alert when a user account is created in Microsoft Entra ID. Which rule type should you configure?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) to detect specific events like user account creation in Microsoft Entra ID (Azure AD). This rule type is designed for custom detection scenarios where you need to match exact log patterns, such as the AuditLogs event 'Add user', and trigger an alert based on the results.

Answer

Near-Real-Time (NRT) rule

Answer

Anomaly rule

Answer

Fusion rule

Question 10

Refer to the exhibit. You are evaluating an Azure Policy definition that enables Defender for Cloud on a subscription. The policy uses 'DeployIfNotExists' effect. Which role must be assigned to the managed identity used by this policy to successfully deploy the pricing resource?

Accepted Answer

Security Admin. The DeployIfNotExists effect in Azure Policy requires a managed identity with sufficient permissions to remediate non-compliant resources. For enabling Defender for Cloud pricing, the managed identity needs to create or update the 'pricings' resource under Microsoft.Security, which requires the Security Admin role. This role grants the necessary write permissions to configure security pricing tiers without the broader privileges of Owner or Contributor.

Answer

Owner

Answer

Reader

Answer

Contributor

Question 11

Your company has a hybrid environment with on-premises servers and Azure VMs. You want to use Microsoft Defender for Cloud to assess the security posture of both environments. What do you need to install on the on-premises servers to enable Defender for Cloud monitoring?

Accepted Answer

Azure Arc agent. Azure Arc agent is the correct choice because it extends Azure Resource Manager (ARM) management to non-Azure machines, including on-premises servers. Once the Azure Arc agent is installed, the on-premises server becomes a 'hybrid machine' resource in Azure, enabling Defender for Cloud to assess its security posture using the same policies and vulnerability assessments as Azure VMs, without requiring a separate Log Analytics workspace or MMA agent.

Answer

Microsoft Monitoring Agent (MMA)

Answer

Azure Security Center agent

Answer

Log Analytics agent

Question 12

Your security operations center (SOC) uses Microsoft Sentinel. You need to create a custom analytics rule that detects when a user signs in from a country not in the allowed list and then accesses a high-value SharePoint site within 10 minutes. The rule should generate an incident only if both conditions occur. Which KQL operator should you use in the rule query?

Accepted Answer

join. (join) because the rule requires detecting two sequential events—a sign-in from an unauthorized country and subsequent access to a high-value SharePoint site—that must both occur within a 10-minute window for the same user. The join operator in KQL allows you to correlate two separate data tables (e.g., SigninLogs and SharePointAccessLogs) on a common key (user ID) and enforce a time constraint (e.g., $left.TimeGenerated between $right.TimeGenerated and $right.TimeGenerated + 10m), ensuring that only matching pairs where both conditions are true generate an incident.

Answer

summarize

Answer

union

Answer

where

Question 13

Your organization uses Microsoft Defender for Cloud to protect Azure SQL databases. You need to enable Advanced Threat Protection (ATP) for Azure SQL. Where should you configure this?

Accepted Answer

In the Azure SQL server blade under Security. Advanced Threat Protection (ATP) for Azure SQL is enabled at the Azure SQL server level, not at the individual database level, because ATP policies and threat detection configurations apply to all databases hosted on that server. In the Azure portal, this is configured under the Azure SQL server blade's 'Security' section, specifically in the 'Microsoft Defender for Cloud' pane, where you can enable 'Microsoft Defender for SQL' (which includes ATP). This ensures that all databases on the server inherit the protection, including vulnerability assessment and threat detection alerts.

Answer

In the Microsoft Defender for Cloud subscription settings

Answer

In the Azure resource group where the SQL server resides

Answer

In the Azure SQL database blade under Security

Question 14

Which THREE are valid Microsoft Defender for Cloud plans? (Choose three.)

Accepted Answer

Defender for SQL. Defender for SQL (C) is a valid Microsoft Defender for Cloud plan that protects Azure SQL databases, SQL servers on machines, and other database workloads by detecting anomalous access and potential injection attacks. Defender for Storage (D) is also a legitimate plan that provides threat detection for Azure Storage accounts, flagging suspicious access patterns, unusual data exfiltration, and malicious file uploads. Defender for Servers (E) is likewise a core Defender for Cloud plan that delivers threat detection and vulnerability assessment for Windows and Linux VMs, including integration with Microsoft Defender for Endpoint. In contrast, Defender for Identity (A) and Defender for Office 365 (B) are standalone Microsoft Defender XDR products sold outside the Defender for Cloud plan catalog, so they are not among the valid Defender for Cloud plans.

Answer

Defender for Identity

Answer

Defender for Office 365

Question 15

You are a security engineer for a company that uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions are continuously assessed against the Microsoft cloud security benchmark (MCSB). The solution must automatically assign compliance standards to new subscriptions. What should you do?

Accepted Answer

Assign the MCSB standard to the management group that contains all subscriptions.. Assigning the MCSB standard to the management group that contains all subscriptions ensures that the compliance standard is automatically inherited by all existing and future subscriptions under that management group. This meets the requirement for continuous assessment and automatic assignment to new subscriptions without manual intervention.

Answer

Enable the 'Foundational CSPM' plan in Defender for Cloud at the management group scope.

Answer

Assign the MCSB standard to each subscription individually using the Defender for Cloud regulatory compliance dashboard.

Answer

Create an Azure Policy initiative that enforces MCSB and assign it to the root management group.