AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 5 — 15 Questions

Question 1

Your organization is migrating to Azure and needs to protect against advanced threats like fileless malware. You must use a solution that provides real-time protection and integrates with Microsoft Defender for Cloud. What should you deploy on Azure VMs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Endpoint (Microsoft Defender XDR). Microsoft Defender for Endpoint (part of Microsoft Defender XDR) provides next-generation protection, including behavior-based, real-time detection of fileless malware and other advanced threats. It integrates natively with Microsoft Defender for Cloud to deliver unified security management and automated response for Azure VMs, meeting the requirement for real-time protection against sophisticated attacks.

Answer

Microsoft Antimalware for Azure

Answer

Azure Monitor Agent (AMA)

Answer

Azure Security Center (free tier)

Question 2

You need to ensure that security alerts from Microsoft Defender for Cloud are sent to a central SIEM system. What should you configure?

Accepted Answer

Enable continuous export to Event Hubs. Microsoft Defender for Cloud can stream security alerts and recommendations to an Event Hubs namespace via the 'Continuous export' settings. This enables external SIEM systems, such as Splunk or Azure Sentinel, to ingest the data by connecting to the Event Hubs endpoint. Diagnostic settings export activity logs and metrics, not security alerts, and playbooks are for automated response, not data forwarding.

Answer

Create a playbook that forwards alerts to the SIEM

Answer

Configure diagnostic settings for the subscription

Answer

Assign an Azure Policy to export alerts

Question 3

Which THREE of the following are capabilities of Microsoft Defender for Cloud's workload protection plans?

Accepted Answer

Adaptive application controls. Adaptive application controls (A) are a capability of Microsoft Defender for Cloud's workload protection plans. They use machine learning to analyze processes running on Azure and non-Azure machines, allowing you to define allowlists for known safe applications and generate security alerts when unauthorized applications execute, thus reducing the attack surface.

Answer

DDoS protection

Answer

Data Loss Prevention (DLP)

Question 4

Which TWO of the following are valid data connectors in Microsoft Sentinel?

Accepted Answer

Azure Active Directory (Microsoft Entra ID). Microsoft Sentinel includes a built-in connector for Azure Active Directory (now Microsoft Entra ID) that ingests sign-in logs, audit logs, and provisioning events. This connector is a first-party data source, requiring no additional configuration beyond assigning the appropriate roles (e.g., Security Reader) and enabling the connector in the Sentinel workspace.

Answer

Microsoft SQL Server

Answer

Google Cloud Platform

Answer

VMware vCenter

Question 5

You are a security engineer for a company that uses Microsoft Defender for Cloud with the CSPM (Cloud Security Posture Management) plan enabled. You need to ensure that all Azure subscriptions are assessed against the Microsoft Cloud Security Benchmark (MCSB). Which action should you take?

Accepted Answer

No action needed; MCSB is the default security policy assigned to all subscriptions.. When the CSPM plan is enabled in Microsoft Defender for Cloud, the Microsoft Cloud Security Benchmark (MCSB) is automatically assigned as the default security policy initiative to all Azure subscriptions. No manual assignment is required because MCSB replaces the former Azure Security Benchmark and is applied by default to every subscription that has the CSPM plan enabled. This ensures continuous assessment against MCSB controls without any additional configuration.

Answer

Assign the CIS Microsoft Azure Foundations Benchmark initiative to each subscription.

Answer

Assign the MCSB initiative at the management group level.

Answer

Enable regulatory compliance standards in Defender for Cloud.

Question 6

Your company has Microsoft Sentinel deployed in multiple workspaces across several Azure regions. The security operations team wants to query data from all workspaces centrally using a single KQL query. What feature should you implement?

Accepted Answer

Use cross-workspace queries with the workspace() expression in KQL.. The workspace() expression in KQL allows you to include tables from multiple Log Analytics workspaces in a single query, enabling centralized querying across all Microsoft Sentinel workspaces without moving or aggregating data. This is the native and recommended approach for cross-workspace queries in Azure Sentinel.

Answer

Configure Log Analytics workspaces as linked to a central workspace.

Answer

Export all data to Azure Data Explorer and query there.

Answer

Use the Microsoft Sentinel SIEM connector to aggregate data.

Question 7

You are configuring Microsoft Defender for Cloud to protect your Azure virtual machines. You need to enable just-in-time (JIT) VM access to reduce the attack surface. What prerequisite must be met?

Accepted Answer

Enable Microsoft Defender for Servers Plan 2.. Just-in-time (JIT) VM access in Microsoft Defender for Cloud requires Microsoft Defender for Servers Plan 2 to be enabled. This plan provides the advanced security capabilities, including JIT, vulnerability assessment, and file integrity monitoring. Without Plan 2, the JIT blade and policy options are not available, as Plan 1 only covers basic log collection and threat detection.

Answer

Configure Microsoft Defender for Cloud Apps with the VMs as connected.

Answer

Enable the Defender for Cloud 'JIT' plan.

Answer

Deploy Azure Bastion in the same virtual network.

Question 8

Your security team receives a high-priority alert from Microsoft Sentinel indicating a potential brute-force attack against an Azure SQL Database. The alert was generated by an analytics rule using the following KQL query: 'SigninLogs | where ResultType == "50057" | summarize Count = count() by UserPrincipalName, IPAddress | where Count > 10'. What is the most likely cause of the alert?

Accepted Answer

Multiple sign-in attempts using a disabled account from the same IP address.. The KQL query filters for ResultType == '50057', which specifically indicates 'User Account is Disabled'. The query then counts sign-in attempts by UserPrincipalName and IPAddress, triggering the alert when the count exceeds 10. This means the alert fires when there are more than 10 sign-in attempts from the same user and IP address against a disabled account, which matches the description of a brute-force attack targeting a disabled account.

Answer

Multiple failed MFA attempts by a user.

Answer

A user successfully signed in after many attempts.

Answer

Multiple sign-in attempts from a non-existent user account.

Question 9

You are designing a Microsoft Sentinel deployment for a multinational company. The company requires that data from different geographic regions be stored separately to comply with data residency laws. What is the recommended approach?

Accepted Answer

Deploy a separate Microsoft Sentinel workspace in each required region.. Microsoft Sentinel is built on top of Log Analytics workspaces, and each workspace is a distinct data container with its own retention, encryption, and geographic location. To comply with data residency laws that require data from different regions to be stored separately, you must deploy a separate Sentinel workspace in each required region. This ensures that data ingested from a specific region remains within that region's boundaries and is not mixed with data from other regions.

Answer

Deploy a single Sentinel workspace and use Azure Purview to tag data for residency.

Answer

Deploy a single Sentinel workspace and configure diagnostic settings to send data to separate Log Analytics workspaces.

Answer

Deploy a single Sentinel workspace and use data collection rules to route data to different storage accounts.

Question 10

You need to configure a continuous export of Microsoft Defender for Cloud alerts to a third-party SIEM. Which feature should you use?

Accepted Answer

Use the continuous export feature in Defender for Cloud to stream alerts to an Event Hubs namespace.. The continuous export feature in Microsoft Defender for Cloud is specifically designed to stream security alerts and recommendations to an Event Hubs namespace, which can then be consumed by a third-party SIEM. This native integration eliminates the need for custom polling or scripting, ensuring near real-time data flow with minimal latency.

Answer

Create an Azure Logic App to periodically query and send alerts.

Answer

Use the Defender for Cloud REST API to pull alerts.

Answer

Configure Azure Monitor agent on all VMs.

Question 11

Your company uses Microsoft Sentinel to monitor Azure resources. A new analytics rule is created to detect anomalous access to storage accounts. The rule runs every 5 minutes and looks at the last 15 minutes of data. After deploying, the rule generates no alerts even though you suspect there are anomalies. What is the most likely issue?

Accepted Answer

The rule query logic is incorrect or the entities are not properly mapped.. The most likely issue is that the rule query logic is incorrect or the entities are not properly mapped. In Microsoft Sentinel, an analytics rule uses a KQL query to detect anomalies; if the query syntax is wrong, the logic fails to match the expected data patterns, or the entity mappings (e.g., Account, IP, Host) are misconfigured, the rule will not generate alerts even when anomalous activity exists. Without correct entity mapping, the rule cannot correlate events or trigger incidents, resulting in zero alerts despite underlying anomalies.

Answer

The rule is not enabled.

Answer

The rule severity is set too low.

Answer

The rule query frequency is longer than the data lookback period.

Question 12

You are responsible for securing Azure resources using Microsoft Defender for Cloud. You receive a recommendation that your Azure Kubernetes Service (AKS) cluster has a vulnerability in a container image. The recommendation is labeled 'Container images should be scanned for vulnerabilities'. What action should you take to remediate this recommendation?

Accepted Answer

Rebuild the container image using an updated base image and redeploy.. The recommendation 'Container images should be scanned for vulnerabilities' indicates that a vulnerability has been found in a container image used by your AKS cluster. Remediation requires rebuilding the container image from an updated base image that includes security patches, then redeploying the updated image to the cluster. This directly addresses the root cause by eliminating the vulnerable components from the image.

Answer

Enable the 'Vulnerability assessment solutions should be enabled on your VMs' recommendation.

Answer

Enable Microsoft Defender for Cloud Apps for the AKS cluster.

Answer

Disable the vulnerability scanner for that repository.

Question 13

Your organization wants to use Microsoft Sentinel to automatically respond to high-severity incidents. Which feature should you configure?

Accepted Answer

Create an automation rule that triggers a playbook on incident creation.. Microsoft Sentinel automation rules allow you to define automated responses to incidents, such as triggering a playbook (a collection of actions based on Azure Logic Apps) when an incident is created. This directly meets the requirement to automatically respond to high-severity incidents without manual intervention.

Answer

Create an analytics rule with a high severity.

Answer

Create a workbook to visualize incidents.

Answer

Enable entity behavior analytics.

Question 14

Which TWO of the following are valid methods to ingest data into Microsoft Sentinel? (Select two.)

Accepted Answer

Using the Log Analytics agent to send custom logs.. The Log Analytics agent (now replaced by the Azure Monitor Agent) can be configured to collect custom logs from Windows or Linux machines and forward them to a Log Analytics workspace, which serves as the underlying data store for Microsoft Sentinel. This is a standard ingestion path for on-premises or IaaS-based data sources that are not natively supported by built-in connectors.

Answer

Using the Azure PowerShell cmdlets to send events directly.

Answer

Using Power BI to stream data.

Answer

Using Azure Policy to forward logs.

Question 15

Which THREE of the following are capabilities of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) plan? (Select three.)

Accepted Answer

Continuous assessment of security configurations.. Microsoft Defender for Cloud's CSPM plan continuously assesses your Azure resources against security best practices, identifying misconfigurations and drift in real-time. This continuous assessment is a core capability of CSPM, enabling proactive security posture management.

Answer

Just-in-time (JIT) VM access.

Answer

File Integrity Monitoring (FIM).