AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 4 — 15 Questions

Question 1

Your company uses Microsoft Defender for Cloud to secure its Azure resources. The security team receives alerts about a potential brute-force attack on a Linux virtual machine. You need to verify whether the attack was successful and take immediate remediation actions. Which two Defender for Cloud features should you use together?

Accepted Answer

Enable Just-in-Time (JIT) VM access for the affected VM. Option B is correct because Just-in-Time VM access can block brute-force attempts by allowing only authorized IPs and ports. Option C is correct because the File Integrity Monitoring (FIM) feature can detect changes to critical system files, indicating a successful compromise. Option A is wrong because vulnerability assessment is for checking known vulnerabilities, not real-time attack verification. Option D is wrong because adaptive application controls whitelist applications, not directly related to brute-force detection. Option E is wrong because Azure DDoS Protection is for network-level DDoS, not brute-force attacks.

Answer

Configure adaptive application controls to whitelist allowed applications

Answer

Enable vulnerability assessment and review the findings

Answer

Enable Azure DDoS Protection on the virtual network

Question 2

You are a security analyst using Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from the same IP address within 5 minutes. The rule should use a KQL query. Which query should you use?

Accepted Answer

SigninLogs | where ResultType !in ("0","50125") // failed attempts | summarize Count = count() by IPAddress, bin(TimeGenerated, 5m) | where Count > 10. Option A is correct because it groups failed sign-ins by IP address, counts them within a 5-minute time window, and filters for counts greater than 10. Option B is wrong because it uses time-generated, which is not a standard column; the correct column is TimeGenerated. Option C is wrong because it incorrectly uses 'make-series' which is for time series analysis, not simple aggregation. Option D is wrong because it filters only successful sign-ins.

Answer

SigninLogs | where ResultType != "0" | make-series Count=count() default=0 on TimeGenerated from ago(5m) to now() step 5m by IPAddress

Answer

SigninLogs | where ResultType == "0" | summarize Count = count() by IPAddress, bin(TimeGenerated, 5m) | where Count > 10

Answer

SigninLogs | where ResultType == "0" | summarize Count = count() by IPAddress, bin(time-generated, 5m) | where Count > 10

Question 3

Your organization has multiple Azure subscriptions managed by Microsoft Defender for Cloud. You need to ensure that all subscriptions have the same security policies applied, and that any new subscription automatically inherits these policies. What should you do?

Accepted Answer

Assign a policy initiative at the management group level. Option B is correct because assigning a policy initiative at the management group level ensures all subscriptions under that group inherit the policy, including new ones. Option A is wrong because assigning at the subscription level would require manual assignment for each subscription and won't automatically apply to new ones. Option C is wrong because Azure Blueprints are being deprecated and are not the recommended approach. Option D is wrong because Azure Policy does not support inheritance from a resource group to a subscription.

Answer

Create an Azure Blueprint and assign it to each subscription

Answer

Assign a policy initiative to a resource group and then move subscriptions into that group

Answer

Assign a policy initiative to each subscription individually

Question 4

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). You need to collect sign-in logs and audit logs. Which data connector should you enable?

Accepted Answer

Azure Active Directory (now Microsoft Entra ID). Option A is correct because the 'Azure Active Directory' data connector is specifically designed to ingest both sign-in logs and audit logs. Option B is wrong because the Azure AD Identity Protection connector only brings in risky user and sign-in events, not full audit logs. Option C is wrong because the Office 365 connector brings in Exchange, SharePoint, and Teams logs, not Azure AD logs. Option D is wrong because the Azure AD Authentication connector is not a standard Microsoft Sentinel data connector.

Answer

Azure AD Identity Protection

Answer

Office 365

Answer

Azure AD Authentication

Question 5

Your company uses Microsoft Defender for Cloud to protect Azure resources. You notice that some Azure VMs are not showing any security recommendations. You verify that the VMs are running and have network connectivity. What is the most likely cause?

Accepted Answer

The Log Analytics agent is not installed on the VMs. Option C is correct because if the Log Analytics agent (or Azure Monitor Agent) is not installed, Defender for Cloud cannot collect data and thus cannot generate recommendations. Option A is wrong because pricing tier affects available features but not recommendations entirely; even Free tier provides some recommendations. Option B is wrong because Defender for Cloud uses Azure Policy, not Azure RBAC, to evaluate resources. Option D is wrong because resource locks do not prevent security assessments.

Answer

The VMs are in a resource group that lacks the required Azure RBAC role

Answer

The VMs have a resource lock preventing policy evaluation

Answer

The VMs are in the Free tier of Defender for Cloud

Question 6

You are investigating a security incident in Microsoft Sentinel. The incident involves multiple alerts from different data sources. You need to correlate the alerts to determine the full attack chain. Which Microsoft Sentinel feature should you use?

Accepted Answer

Incident investigation. Option B is correct because incident investigation allows you to visualize and correlate alerts, entities, and events. Option A is wrong because workbooks are for dashboards, not correlation. Option C is wrong because playbooks are for automated response. Option D is wrong because analytics rules create alerts, but correlation is done via investigation.

Answer

Analytics rules

Answer

Playbooks

Answer

Workbooks

Question 7

Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all Azure SQL databases have Advanced Data Security enabled. What should you do?

Accepted Answer

Create an Azure Policy to enforce Advanced Data Security. Option C is correct because you can create an Azure Policy to audit or enforce the setting. Option A is wrong because enabling on each database individually is not scalable. Option B is wrong because Azure Security Center does not provide a global enablement switch for SQL databases. Option D is wrong because Azure SQL Firewall rules are for network access, not security features.

Answer

Enable Advanced Data Security on each database manually

Answer

Use the Azure Security Center dashboard to enable it for all databases

Answer

Configure the Azure SQL Firewall to allow only secure connections

Question 8

You are configuring Microsoft Sentinel to use a playbook for automated response to incidents. The playbook needs to block the source IP address of a malicious sign-in on the Azure Firewall. Which Microsoft Sentinel feature should the playbook use?

Accepted Answer

Azure Logic Apps. Option B is correct because Azure Logic Apps is the engine that runs playbooks. Option A is wrong because KQL is a query language, not an automation tool. Option C is wrong because Azure Functions can be used within logic apps but are not the primary playbook runner. Option D is wrong because Azure Automation runbooks are not directly integrated with Sentinel playbooks.

Answer

Azure Automation runbooks

Answer

Azure Functions

Answer

KQL queries

Question 9

Your company uses Microsoft Defender for Cloud's Security Posture Management (CSPM) features. You need to identify resources that are not compliant with the organization's security baseline. What should you do?

Accepted Answer

Use the regulatory compliance dashboard. Option C is correct because the regulatory compliance dashboard shows compliance status against various standards, including custom baselines. Option A is wrong because secure score is an aggregate score, not a detailed compliance view. Option B is wrong because recommendations are individual findings, not a compliance overview. Option D is wrong because inventory shows resources, not compliance.

Answer

View the secure score

Answer

Review the security recommendations

Answer

Use the inventory blade

Question 10

Refer to the exhibit. You are reviewing an Azure Policy initiative definition in Microsoft Defender for Cloud. The initiative includes a policy definition with reference ID 'CIS-1.1'. The policy definition ID is '/providers/Microsoft.Authorization/policyDefinitions/abc123'. You need to verify that the policy definition exists and is correctly assigned. Which Azure CLI command should you run?

Accepted Answer

az policy definition show --id /providers/Microsoft.Authorization/policyDefinitions/abc123. Option A is correct because 'az policy definition show' retrieves details of a policy definition by ID. Option B is wrong because 'az policy assignment list' lists assignments, not definitions. Option C is wrong because 'az policy set-definition show' shows initiative definitions, not individual definitions. Option D is wrong because 'az policy definition list' lists all definitions, not a specific one.

Answer

az policy assignment list --query "[?policyDefinitionId=='/providers/Microsoft.Authorization/policyDefinitions/abc123']"

Answer

az policy set-definition show --name "CIS Benchmark v1.1.0"

Answer

az policy definition list --query "[?id=='/providers/Microsoft.Authorization/policyDefinitions/abc123']"

Question 11

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. The query returns a list of IP addresses that have attempted to sign in more than 10 times in the last day. You notice that the query does not filter out successful sign-ins. You need to modify the query to count only failed sign-in attempts. What should you add?

Accepted Answer

Add '| where ResultType != "0"' before the summarize. Option C is correct because filtering by ResultType != "0" excludes successful sign-ins (ResultType == "0"). Option A is wrong because ResultType == "0" only includes successful sign-ins. Option B is wrong because Status is not a column; the correct column is ResultType. Option D is wrong because the column is ResultType, not Result.

Answer

Add '| where Status == "Failure"' before the summarize

Answer

Add '| where Result == "Failure"' before the summarize

Answer

Add '| where ResultType == "0"' before the summarize

Question 12

Refer to the exhibit. You are reviewing the Microsoft Defender for Cloud settings for a subscription. The JSON shows that 'autoProvision' is set to true. What does this mean?

Accepted Answer

The Log Analytics agent is automatically installed on new Azure VMs. Option B is correct because autoProvision refers to automatic provisioning of the Log Analytics agent on new VMs. Option A is wrong because autoProvision does not enable all Defender plans. Option C is wrong because it does not automatically assign policies. Option D is wrong because it does not enable continuous export.

Answer

All Microsoft Defender plans are automatically enabled for new resources

Answer

Security policies are automatically assigned to new resource groups

Answer

Continuous export of security alerts is enabled

Question 13

Your organization has Microsoft Sentinel deployed in the East US region. You need to ensure that security logs are retained for 2 years to meet compliance requirements. The workspace retention policy is set to 90 days. What should you do?

Accepted Answer

Configure data retention for the specific tables that need long-term retention. Option A is correct because you can configure data retention for specific tables up to 2 years using the Azure portal or API. Option B is wrong because archiving to a storage account would require additional configuration and is not a direct retention setting. Option C is wrong because changing the workspace retention policy to 2 years is possible but may incur high costs; however, it is a valid option. But the question implies a cost-effective solution: table-level retention. Option A is more precise. Option D is wrong because Azure Policy does not change retention settings.

Answer

Change the workspace retention setting to 730 days

Answer

Use Azure Policy to enforce retention on the Log Analytics workspace

Answer

Export logs to an Azure Storage account and set a lifecycle management policy

Question 14

You are using Microsoft Defender for Cloud to protect Azure Kubernetes Service (AKS) clusters. You need to receive alerts about suspicious activities within the cluster, such as privilege escalations. What should you enable?

Accepted Answer

Microsoft Defender for Containers. Option A is correct because Microsoft Defender for Containers provides threat detection for AKS clusters, including privilege escalation alerts. Option B is wrong because Azure Policy for AKS enforces security configurations but does not generate alerts. Option C is wrong because Microsoft Sentinel is a separate SIEM that can ingest logs but is not the primary alerting mechanism within Defender for Cloud. Option D is wrong because Azure Security Center, now Defender for Cloud, includes container protections.

Answer

Microsoft Sentinel with AKS data connector

Answer

Azure Policy for AKS

Answer

Azure Security Center (classic)

Question 15

Your organization uses Microsoft Sentinel to manage security incidents. You need to configure automated response to block a user account when a high-severity incident is triggered. The response should be automatically executed when the incident is created. What should you create?

Accepted Answer

An automation rule that triggers a playbook. Option C is correct because an automation rule in Microsoft Sentinel can trigger a playbook when an incident is created. Option A is wrong because a playbook alone does not automatically trigger on incident creation; it needs an automation rule. Option B is wrong because analytics rules generate alerts, not automated responses. Option D is wrong because a workbook is a visualization tool.

Answer

An analytics rule

Answer

A playbook

Answer

A workbook