AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 4 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all Azure SQL databases have Advanced Data Security enabled. What should you do?

Accepted Answer

Create an Azure Policy to enforce Advanced Data Security. Azure Policy can be used to enforce Advanced Data Security (ADS) at scale across all Azure SQL databases in a subscription or management group. By creating a policy that requires ADS to be enabled, any non-compliant database is automatically flagged or remediated, ensuring consistent security posture without manual intervention. This aligns with the principle of using policy-driven governance to enforce security controls across Azure resources.

Answer

Enable Advanced Data Security on each database manually

Answer

Use the Azure Security Center dashboard to enable it for all databases

Answer

Configure the Azure SQL Firewall to allow only secure connections

Question 2

You are configuring Microsoft Sentinel to use a playbook for automated response to incidents. The playbook needs to block the source IP address of a malicious sign-in on the Azure Firewall. Which Microsoft Sentinel feature should the playbook use?

Accepted Answer

Azure Logic Apps. Microsoft Sentinel playbooks are built on Azure Logic Apps, which provide the workflow automation and connectors needed to orchestrate response actions like blocking an IP on Azure Firewall. Logic Apps can integrate with Azure Firewall via its REST API or the Azure Resource Manager connector to update firewall rules, making it the correct feature for this automated incident response task.

Answer

Azure Automation runbooks

Answer

Azure Functions

Answer

KQL queries

Question 3

Your company uses Microsoft Defender for Cloud's Security Posture Management (CSPM) features. You need to identify resources that are not compliant with the organization's security baseline. What should you do?

Accepted Answer

Use the regulatory compliance dashboard. The regulatory compliance dashboard in Microsoft Defender for Cloud provides a view of how your resources comply with specific security standards and baselines, such as the Microsoft Cloud Security Benchmark (MCSB) or custom regulatory frameworks. By selecting the appropriate compliance standard that matches your organization's security baseline, you can identify resources that are non-compliant with specific controls. This dashboard directly maps security assessments to compliance controls, making it the correct tool for identifying resources not meeting your baseline.

Answer

View the secure score

Answer

Review the security recommendations

Answer

Use the inventory blade

Question 4

Refer to the exhibit. You are reviewing an Azure Policy initiative definition in Microsoft Defender for Cloud. The initiative includes a policy definition with reference ID 'CIS-1.1'. The policy definition ID is '/providers/Microsoft.Authorization/policyDefinitions/abc123'. You need to verify that the policy definition exists and is correctly assigned. Which Azure CLI command should you run?

Accepted Answer

az policy definition show --id /providers/Microsoft.Authorization/policyDefinitions/abc123. The `az policy definition show --id` command retrieves the details of a specific policy definition by its full resource ID. Since the question asks to verify that the policy definition with ID '/providers/Microsoft.Authorization/policyDefinitions/abc123' exists and is correctly assigned, this command directly confirms its existence and properties without filtering through a list.

Answer

az policy assignment list --query "[?policyDefinitionId=='/providers/Microsoft.Authorization/policyDefinitions/abc123']"

Answer

az policy set-definition show --name "CIS Benchmark v1.1.0"

Answer

az policy definition list --query "[?id=='/providers/Microsoft.Authorization/policyDefinitions/abc123']"

Question 5

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. The query returns a list of IP addresses that have attempted to sign in more than 10 times in the last day. You notice that the query does not filter out successful sign-ins. You need to modify the query to count only failed sign-in attempts. What should you add?

Accepted Answer

Add '| where ResultType != "0"' before the summarize. In Microsoft Sentinel, the KQL query for sign-in logs uses the 'ResultType' field to indicate success or failure. A 'ResultType' of '0' represents a successful sign-in, while any non-zero value indicates a failure. Therefore, to count only failed sign-in attempts, you must filter with '| where ResultType != "0"' before the summarize operator. Option D correctly applies this filter, excluding successful sign-ins and ensuring the count reflects only failures.

Answer

Add '| where Status == "Failure"' before the summarize

Answer

Add '| where Result == "Failure"' before the summarize

Answer

Add '| where ResultType == "0"' before the summarize

Question 6

Refer to the exhibit. You are reviewing the Microsoft Defender for Cloud settings for a subscription. The JSON shows that 'autoProvision' is set to true. What does this mean?

Accepted Answer

The Log Analytics agent is automatically installed on new Azure VMs. When 'autoProvision' is set to true in Microsoft Defender for Cloud, it means the Log Analytics agent (formerly Microsoft Monitoring Agent) is automatically installed on all existing and new Azure VMs in the subscription. This agent collects security-related telemetry and sends it to the Log Analytics workspace associated with Defender for Cloud, enabling threat detection and security monitoring. The setting does not enable any Defender plans or policies—it only controls agent deployment.

Answer

All Microsoft Defender plans are automatically enabled for new resources

Answer

Security policies are automatically assigned to new resource groups

Answer

Continuous export of security alerts is enabled

Question 7

Your organization has Microsoft Sentinel deployed in the East US region. You need to ensure that security logs are retained for 2 years to meet compliance requirements. The workspace retention policy is set to 90 days. What should you do?

Accepted Answer

Configure data retention for the specific tables that need long-term retention. Microsoft Sentinel allows you to configure table-level retention in Log Analytics workspaces, overriding the workspace default retention of 90 days. By setting the retention period to 730 days (2 years) on specific tables containing security logs, you meet compliance requirements without affecting other tables. This is the recommended approach for long-term retention of security data in Sentinel.

Answer

Change the workspace retention setting to 730 days

Answer

Use Azure Policy to enforce retention on the Log Analytics workspace

Answer

Export logs to an Azure Storage account and set a lifecycle management policy

Question 8

Your organization uses Microsoft Sentinel to manage security incidents. You need to configure automated response to block a user account when a high-severity incident is triggered. The response should be automatically executed when the incident is created. What should you create?

Accepted Answer

An automation rule that triggers a playbook. Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created, including running a playbook to block a user account. This directly meets the requirement for an automatic response upon incident creation without manual intervention.

Answer

An analytics rule

Answer

A playbook

Answer

A workbook

Question 9

You need to ensure that all Azure subscriptions in your tenant are automatically assessed for security misconfigurations and compliance against Microsoft cloud security benchmark. What should you configure?

Accepted Answer

Assign an initiative via Azure Policy to all subscriptions. The Microsoft cloud security benchmark is a built-in initiative in Azure Policy. By assigning this initiative to all subscriptions, you automatically assess them for security misconfigurations and compliance. Defender for Cloud uses these policies, but ensuring the assessment requires the initiative assignment. Option C is incorrect because enabling continuous export only streams completed assessment data; it does not trigger the assessment itself.

Answer

Deploy Microsoft Sentinel with automatic data connectors

Answer

Enable continuous export in Microsoft Defender for Cloud

Answer

Create a blueprint definition and assign it to management group

Question 10

Your security team detects a series of failed sign-ins from multiple IP addresses for a privileged user account in Microsoft Entra ID. You need to automatically create an incident in Microsoft Sentinel and block the user account. What should you configure?

Accepted Answer

Configure automated investigation and remediation in Microsoft Defender XDR. Microsoft Defender XDR's automated investigation and remediation (AIR) can be configured to automatically block a user account when a series of failed sign-ins from multiple IP addresses is detected. This capability leverages the unified incident and alert correlation across Defender for Identity, Defender for Cloud Apps, and Entra ID Protection to trigger a response action (e.g., disabling the user) without requiring a custom playbook or manual intervention.

Answer

Create a playbook in Microsoft Sentinel that triggers on the sign-in logs

Answer

Use Microsoft Entra ID Protection to automatically remediate risk

Answer

Set up a detection rule in Microsoft Sentinel that sends an email to security admins

Question 11

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to collect logs from on-premises Linux servers and send them to Sentinel. The solution must minimize latency and administrative overhead. What should you deploy?

Accepted Answer

Connect servers via Azure Arc and install the Azure Monitor Agent. Azure Arc bridges on-premises Linux servers to Azure, enabling the deployment of the Azure Monitor Agent (AMA) without requiring a direct internet connection or complex proxy configurations. The AMA uses a single, lightweight agent for both platform and custom logs, reducing latency by sending data directly to the Log Analytics workspace via HTTPS on port 443, and it minimizes administrative overhead through centralized management via data collection rules (DCRs). This approach is the recommended modern method for hybrid log collection in Microsoft Sentinel.

Answer

Use the Microsoft Monitoring Agent to send logs directly

Answer

Configure a syslog server to forward logs to the Log Analytics workspace

Answer

Install the Log Analytics agent on each server

Question 12

You need to prioritize security recommendations in Microsoft Defender for Cloud. Your compliance team requires a framework that maps to regulatory standards. What should you use?

Accepted Answer

Regulatory compliance standards. Regulatory compliance standards in Microsoft Defender for Cloud map security recommendations to specific regulatory frameworks (e.g., SOC 2, PCI DSS, ISO 27001), enabling the compliance team to prioritize based on regulatory requirements. The secure score (Option D) provides an overall posture but does not map to specific standards. Azure Policy compliance dashboard (Option B) is used for policy enforcement, not recommendation prioritization. Inventory (Option C) lists resources without compliance mapping.

Answer

Azure Policy compliance dashboard

Answer

Inventory feature

Answer

Secure score

Question 13

Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all Azure SQL databases have Advanced Data Security enabled. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VMs are using the legacy Log Analytics agent instead of the Azure Monitor Agent. The most likely cause is that the VMs are using the legacy Log Analytics agent (also known as the Microsoft Monitoring Agent or OMS agent) instead of the Azure Monitor Agent (AMA). Defender for Cloud requires the Azure Monitor Agent to report security data for features like vulnerability assessments, file integrity monitoring, and security alerts. The legacy agent does not support these advanced security data collection capabilities, even if it is installed and running.

Answer

Auto-provisioning is disabled for the subscription

Answer

The VMs are running an unsupported operating system

Answer

The VMs do not have network connectivity to the Log Analytics workspace

Question 14

You are designing a Microsoft Sentinel solution for a multinational company. The company requires that security incidents be correlated across regions, but data residency mandates require logs to remain in their original region. What should you implement?

Accepted Answer

Deploy one Microsoft Sentinel workspace per region and use cross-workspace querying for correlation. Deploying one Microsoft Sentinel workspace per region satisfies data residency mandates by keeping logs in their original region, while cross-workspace querying allows security incidents to be correlated across regions using KQL queries that span multiple workspaces. This approach ensures compliance with regional data sovereignty laws without sacrificing the ability to perform centralized threat detection and investigation.

Answer

Deploy a separate Log Analytics workspace per region, but only one Sentinel workspace

Answer

Deploy a single Microsoft Sentinel workspace in a central region and use Azure Lighthouse

Answer

Deploy a single Microsoft Sentinel workspace and use data collection rules to filter logs

Question 15

Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all Azure SQL databases have Advanced Data Security enabled. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the SQL database auditing logs to identify the source queries. SQL database auditing logs capture detailed information about database events, including the exact SQL queries executed against the database. Reviewing these logs allows you to identify the source queries, the originating IP addresses, and the user accounts involved in the suspected SQL injection attack, enabling you to validate the alert and take targeted remediation actions. This is the most effective immediate step to confirm the attack and understand its scope before implementing broader security controls.

Answer

Enable Transparent Data Encryption (TDE) on the database

Answer

Run a vulnerability assessment on the database

Answer

Immediately block all IP addresses from the alert in the SQL firewall