AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 5 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and wants to create a custom analytics rule to detect failed logon attempts from a specific IP address. The rule should run every hour and look for the event in the SecurityEvent table. However, the rule never triggers even though the events exist. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Log Analytics agent is not installed on the machines generating the events.. The SecurityEvent table is populated exclusively by the Log Analytics agent (formerly Microsoft Monitoring Agent) on Windows machines. If the agent is not installed on the machines generating the failed logon events, those events never reach the Log Analytics workspace, so the Sentinel analytics rule querying the SecurityEvent table will find zero results regardless of the rule's configuration.

Answer

The entity mapping in the rule is incomplete.

Answer

The analytics rule does not have the required permissions to query the workspace.

Answer

The rule query uses a time range that is too short.

Question 2

Which TWO actions can you perform using Microsoft Defender for Cloud's 'Security Alerts' page?

Accepted Answer

View the kill chain of an alert.. Option A is correct because the Security Alerts page in Microsoft Defender for Cloud lets you open an alert and view its kill chain, showing the sequence of related alerts and the attack progression across resources. Option B is correct because the Security Alerts page provides a Suppress option that lets you suppress a specific alert for a defined time period, using rules based on fields such as resource, alert name, or entity. Option C is not correct because running remediation scripts is not an action available from the Security Alerts page; remediation is handled through recommendations or workflow automation. Option D is not correct because automation rules and playbook triggers are configured on the Automation rules (or Workflow automation) page, not from the Security Alerts page. Option E is not correct because modifying the subscription's security policy is done through the Security policy page or Azure Policy, not from the Security Alerts page.

Answer

Run a remediation script against the affected resource.

Answer

Create an automation rule to trigger a playbook.

Answer

Modify the security policy of the subscription.

Question 3

Which THREE features are part of Microsoft Defender XDR (formerly Microsoft 365 Defender) integration with Microsoft Sentinel?

Accepted Answer

Automatic triggering of Microsoft 365 Defender playbooks from Sentinel.. Option C is correct because Microsoft Sentinel's Microsoft Defender XDR (formerly Microsoft 365 Defender) connector supports automated response by allowing Sentinel automation rules and playbooks to trigger actions in Microsoft 365 Defender, including invoking Defender XDR playbooks. Option D is correct because the integration correlates alerts from Microsoft 365 Defender workloads (Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps) into unified incidents that are surfaced and managed in Microsoft Sentinel. Option E is correct because the connector ingests Microsoft 365 Defender advanced hunting data—specifically the raw event tables such as DeviceEvents, EmailEvents, and IdentityLogonEvents—into Sentinel for KQL-based hunting and analytics. Option A is not part of the Sentinel–Defender XDR integration; blocking downloads is a Defender for Cloud Apps governance/conditional access capability, not a Sentinel connector feature. Option B is also not part of this integration, since Microsoft Purview data classification is a separate compliance capability and is not a component of the Microsoft Defender XDR connector for Sentinel.

Answer

Integration with Microsoft Defender for Cloud Apps to block downloads.

Answer

Integration with Microsoft Purview for data classification.

Question 4

Which TWO Microsoft Defender for Cloud plans specifically provide threat detection for Azure Storage?

Accepted Answer

Defender for Storage. Defender for Storage (option A) is correct because it is the current Microsoft Defender for Cloud plan that delivers storage threat detection, including activity monitoring, malware scanning, and sensitive data threat detection for Azure Storage accounts. Defender for Storage (classic) (option E) is also correct because it is the legacy plan that provides the original storage threat detection capabilities for Azure Storage, such as detecting unusual access patterns and suspicious activity. Defender for Servers (option B) protects virtual machines and server workloads, not Azure Storage, so it does not belong. Defender for SQL (option C) focuses on databases such as Azure SQL and SQL Server, not storage accounts. Defender for App Service (option D) protects App Service web apps and their compute environments, not Azure Storage.

Answer

Defender for Servers

Answer

Defender for SQL

Answer

Defender for App Service

Question 5

Your security team receives an alert from Microsoft Defender for Cloud indicating 'Suspicious PowerShell script detected' on a virtual machine. The VM is running a critical application, and you need to investigate without disrupting the service. Which action should you take first?

Accepted Answer

Initiate a live response session from Microsoft Defender for Cloud.. Initiating a live response session from Microsoft Defender for Cloud allows you to remotely investigate the VM in real time without disrupting the critical application. Live response provides forensic tools (e.g., running scripts, collecting artifacts, examining processes) directly on the VM while it remains operational, which is essential for a production system. This aligns with the need to investigate the suspicious PowerShell script without taking the VM offline or impacting service availability.

Answer

Disconnect the VM from the virtual network.

Answer

Take a VM snapshot and analyze it offline.

Answer

Restart the VM to clear any malicious processes.

Question 6

You need to configure Microsoft Defender for Cloud to automatically remediate misconfigurations in Azure resources. Which feature should you enable?

Accepted Answer

Enable 'Remediate' on a built-in or custom policy initiative.. Microsoft Defender for Cloud's 'Remediate' feature on a built-in or custom policy initiative automatically applies corrective actions when a resource is found non-compliant with a security policy. This leverages Azure Policy's 'deployIfNotExists' or 'modify' effects to fix misconfigurations without manual intervention, directly addressing the requirement for automated remediation.

Answer

Configure security contacts to receive alert emails.

Answer

Create a workflow automation to run a Logic App on alerts.

Answer

Use the regulatory compliance dashboard to enforce standards.

Question 7

Your organization uses Microsoft Sentinel and wants to create a custom analytics rule to detect failed logon attempts from a specific IP address. The rule should run every hour and look for the event in the SecurityEvent table. However, the rule never triggers even though the events exist. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Near-real-time (NRT) rule. A Near-real-time (NRT) rule is designed to process streaming telemetry with minimal latency, making it ideal for detecting patterns like more than 10 failed logon attempts within 5 minutes from the same source IP. NRT rules evaluate events as they arrive in the Log Analytics workspace, typically within a 1-2 minute window, and can trigger incidents based on threshold conditions across a short time span without requiring a scheduled query.

Answer

Fusion rule

Answer

ML Behavior Analytics rule

Answer

Scheduled query rule

Question 8

You are configuring Microsoft Defender for Cloud for a multi-subscription environment. You need to ensure that security alerts are aggregated in a central location and that a single team can manage recommendations across all subscriptions. What should you use?

Accepted Answer

Assign a management group to aggregate security data.. The correct option is C: assign a management group to aggregate security data. In Microsoft Defender for Cloud, management groups provide a hierarchical scope that spans multiple subscriptions, allowing a single security team to view and manage recommendations, secure scores, and alerts across all subscriptions from one place. This is the intended Azure construct for multi-subscription governance and centralized security posture management. Option A is incorrect because a resource group is scoped to a single subscription and cannot aggregate security data across subscriptions. Option B is incorrect because a Log Analytics workspace centralizes log data but does not by itself provide the cross-subscription management and recommendations view that a management group enables. Option D is incorrect because consolidating all resources into one subscription defeats the purpose of multi-subscription isolation and is not the recommended approach for centralized management.

Answer

Use a resource group to collect all security resources.

Answer

Use a single Log Analytics workspace for all subscriptions.

Answer

Create a single subscription for all resources.

Question 9

You receive a Microsoft Defender for Cloud recommendation: 'Azure Policy Add-on for Kubernetes should be installed and enabled on your clusters'. The recommendation is marked as 'Unhealthy' for your AKS cluster. However, you have already installed the Azure Policy add-on. What is the most likely cause?

Accepted Answer

The AKS cluster does not have the 'azurepolicy' namespace.. The Azure Policy add-on for AKS requires a specific namespace named 'azurepolicy' to be present on the cluster. Even if the add-on is installed, if this namespace is missing or has been deleted, the add-on cannot function correctly, causing Microsoft Defender for Cloud to report the recommendation as 'Unhealthy'. The namespace is created automatically during the add-on installation, but manual deletion or a misconfiguration can lead to this state.

Answer

A custom Azure Policy initiative overrides the built-in one.

Answer

The cluster's network policy is blocking the add-on's webhook.

Answer

The Microsoft Defender for Cloud agent is not installed on the cluster.

Question 10

You need to enable Microsoft Defender for Cloud's enhanced security features for an Azure subscription. Which of the following is required?

Accepted Answer

Enable 'Microsoft Defender for Cloud' at the subscription level.. To enable Microsoft Defender for Cloud's enhanced security features, you must enable 'Microsoft Defender for Cloud' at the subscription level. This action activates the Defender plans (e.g., Defender for Servers, Defender for SQL) for the entire subscription, allowing you to then configure individual plans as needed. Without this subscription-level enablement, the enhanced security capabilities remain off by default.

Answer

Enable all Defender plans at once.

Answer

Deploy a Log Analytics workspace in the same region.

Answer

Assign an Azure Policy to enforce Defender for Cloud.

Question 11

Your organization uses Microsoft Sentinel and wants to create a custom analytics rule to detect failed logon attempts from a specific IP address. The rule should run every hour and look for the event in the SecurityEvent table. However, the rule never triggers even though the events exist. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use SecurityEvent where EventID = 4720 and TimeGenerated !between (9:00 and 17:00).. It uses `EventID = 4720` to identify user account creation events (Windows security event ID for account creation) and filters with `TimeGenerated !between (9:00 and 17:00)` to exclude business hours. This ensures the rule triggers only when a user account is created outside of 9 AM–5 PM, generating an incident as required.

Answer

Use SecurityEvent where AccountCreated and TimeGenerated !between (9:00 and 17:00).

Answer

Use SecurityEvent where AccountCreated and TimeGenerated between 9:00 and 17:00.

Answer

Use SecurityEvent where AccountCreated and then schedule the rule to run only during non-business hours.

Question 12

Which THREE components are required to enable Microsoft Defender for Cloud's just-in-time (JIT) VM access?

Accepted Answer

A network security group (NSG) associated with the VM's subnet or NIC.. Option B is correct because JIT VM access works by creating deny rules in the network security group (NSG) attached to the VM's NIC or subnet, then opening temporary allow rules on the requested port for the requesting source IP when access is approved. Option D is correct because enabling JIT requires the VM to be connected to a Log Analytics workspace (via the Log Analytics agent/AMA and the security data connector) so that Defender for Cloud can report on and manage the VM's JIT status. Option E is correct because JIT is designed to protect management ports (RDP 3389, SSH 22, WinRM 5985/5986) that are exposed to the internet, so the VM must have a public IP address reachable from the internet for the scenario to apply. Option A is not required because Azure Bastion is an alternative secure-access method and is not a prerequisite for JIT; JIT manipulates NSG rules directly. Option C is not required because Azure Firewall is a separate network security service and JIT does not depend on it.

Answer

Azure Bastion configured for the virtual network.

Answer

Azure Firewall deployed in the same region.

Question 13

Which TWO types of data can Microsoft Sentinel ingest from Microsoft Defender XDR?

Accepted Answer

Incidents from Microsoft Defender XDR.. Microsoft Sentinel's built-in Microsoft Defender XDR connector ingests incidents from Microsoft Defender XDR (option B), which are the correlated, cross-workload incident records generated by the XDR engine, and it also ingests the individual alerts from Microsoft Defender for Endpoint (option C), which are the endpoint-level detections that feed those incidents. These two data types are exactly what the Defender XDR connector is designed to stream into Sentinel, enabling incident creation and investigation in the Sentinel workspace. Option A is incorrect because raw Windows event logs are collected via the Log Analytics agent/AMA or the Windows Security Events connector, not through the Defender XDR connector. Option D is incorrect because Microsoft Entra ID (Microsoft Entra ID) sign-in logs are ingested through the Microsoft Entra ID/Entra ID connector or diagnostic settings. Option E is incorrect because Microsoft 365 audit logs are ingested via the Office 365 connector, not the Defender XDR connector.

Answer

Raw Windows event logs from endpoints.

Answer

Azure AD sign-in logs.

Answer

Microsoft 365 audit logs.

Question 14

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. You notice that a critical recommendation 'Vulnerabilities in virtual machines should be remediated' is showing a healthy status of 0% compliance. Which action should you take first to enable vulnerability assessment for all VMs?

Accepted Answer

Enable the 'Vulnerability assessment for VMs' setting in Defender for Cloud's environment settings.. The correct option is D: enabling the 'Vulnerability assessment for VMs' setting in Defender for Cloud's environment settings. This setting turns on the built-in vulnerability assessment capability that the 'Vulnerabilities in virtual machines should be remediated' recommendation depends on, allowing Defender for Cloud to discover and assess VMs without requiring a separate plan upgrade or policy initiative. Option A is incorrect because the Azure Monitor Agent collects telemetry/logs and does not provide vulnerability scanning. Option B is incorrect because Defender for Servers P2 enables advanced server protections but is not the specific first action to turn on VM vulnerability assessment. Option C is incorrect because the policy initiative deploys a vulnerability assessment provider configuration but is not the direct environment setting that enables the assessment feature.

Answer

Install the Azure Monitor Agent on each VM and configure log collection.

Answer

Enable the 'Defender for Servers' plan P2 on the subscription.

Answer

Create a policy assignment to deploy the 'Configure machines to receive a vulnerability assessment provider' initiative.

Question 15

A security analyst reports that a high-priority alert in Microsoft Sentinel for 'Malware detected on VM' was closed without investigation. You need to ensure that all alerts of severity High and above cannot be closed without adding a comment. What should you configure in Sentinel?

Accepted Answer

Modify the 'Analytics rule settings' to require a closing comment for high severity.. Microsoft Sentinel's analytics rule settings include a 'Grouping' and 'Incident settings' section where you can configure 'Closure reason' and 'Closure comment' requirements. By modifying the analytics rule to require a closing comment for incidents of High severity and above, you enforce that analysts must provide a comment before closing any high-priority alert, preventing the scenario described.

Answer

Enable UEBA (User and Entity Behavior Analytics) to track closure patterns.

Answer

Create an automation rule that sets the incident severity and requires a comment when closing.

Answer

Configure a playbook that checks for comments before closing.