AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 5 — 15 Questions

Question 1

You need to ensure that all Azure subscriptions in your tenant are automatically assessed for security misconfigurations and compliance against Microsoft cloud security benchmark. What should you configure?

Accepted Answer

Enable continuous export in Microsoft Defender for Cloud. The correct answer is A. Microsoft Defender for Cloud's continuous export feature automatically assesses all subscriptions for security misconfigurations and compliance. Option B is wrong because Azure Policy initiative assignment is used for compliance but not continuous assessment. Option C is wrong because Azure Blueprints are deprecated. Option D is wrong because Microsoft Sentinel is for SIEM, not continuous assessment.

Answer

Deploy Microsoft Sentinel with automatic data connectors

Answer

Assign an initiative via Azure Policy to all subscriptions

Answer

Create a blueprint definition and assign it to management group

Question 2

Your security team detects a series of failed sign-ins from multiple IP addresses for a privileged user account in Microsoft Entra ID. You need to automatically create an incident in Microsoft Sentinel and block the user account. What should you configure?

Accepted Answer

Configure automated investigation and remediation in Microsoft Defender XDR. Option B is correct because Microsoft Defender XDR provides automated investigation and remediation. Option A is wrong because a playbook can create incidents but not automatically block. Option C is wrong because Azure AD Identity Protection only provides risk detection. Option D is wrong because a detection rule triggers alerts but not automated response.

Answer

Create a playbook in Microsoft Sentinel that triggers on the sign-in logs

Answer

Use Microsoft Entra ID Protection to automatically remediate risk

Answer

Set up a detection rule in Microsoft Sentinel that sends an email to security admins

Question 3

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to collect logs from on-premises Linux servers and send them to Sentinel. The solution must minimize latency and administrative overhead. What should you deploy?

Accepted Answer

Connect servers via Azure Arc and install the Azure Monitor Agent. Option C is correct because Azure Arc enables management of on-premises servers and allows installation of the Azure Monitor Agent with minimal overhead. Option A is wrong because the legacy Log Analytics agent is deprecated. Option B is wrong because Syslog forwarding adds latency. Option D is wrong because the Microsoft Monitoring Agent is the legacy agent.

Answer

Use the Microsoft Monitoring Agent to send logs directly

Answer

Configure a syslog server to forward logs to the Log Analytics workspace

Answer

Install the Log Analytics agent on each server

Question 4

You need to prioritize security recommendations in Microsoft Defender for Cloud. Your compliance team requires a framework that maps to regulatory standards. What should you use?

Accepted Answer

Regulatory compliance standards. Option D is correct because regulatory compliance standards in Defender for Cloud map recommendations to specific frameworks. Option A is wrong because secure score is for overall posture. Option B is wrong because Azure Policy is the underlying engine. Option C is wrong because inventory lists resources.

Answer

Azure Policy compliance dashboard

Answer

Inventory feature

Answer

Secure score

Question 5

Your organization uses Microsoft Defender for Cloud to protect Azure VMs. You notice that some VMs are not reporting security data. You verify that the Log Analytics agent is installed and running. What is the most likely cause?

Accepted Answer

The VMs are using the legacy Log Analytics agent instead of the Azure Monitor Agent. Option B is correct because the Azure Monitor Agent (AMA) is the current agent and the Log Analytics agent (MMA) is deprecated. If AMA is not installed, data may not be collected. Option A is wrong because network connectivity would cause a different error. Option C is wrong because the agent is running. Option D is wrong because auto-provisioning is a setting, not a cause if agent is installed.

Answer

Auto-provisioning is disabled for the subscription

Answer

The VMs are running an unsupported operating system

Answer

The VMs do not have network connectivity to the Log Analytics workspace

Question 6

You are designing a Microsoft Sentinel solution for a multinational company. The company requires that security incidents be correlated across regions, but data residency mandates require logs to remain in their original region. What should you implement?

Accepted Answer

Deploy one Microsoft Sentinel workspace per region and use cross-workspace querying for correlation. Option A is correct because one Sentinel workspace per region with cross-workspace querying allows correlation while keeping data resident. Option B is wrong because a single workspace would violate data residency. Option C is wrong because a single workspace with a different data collection rule does not solve residency. Option D is wrong because a different log analytics workspace per region is not correlated.

Answer

Deploy a separate Log Analytics workspace per region, but only one Sentinel workspace

Answer

Deploy a single Microsoft Sentinel workspace in a central region and use Azure Lighthouse

Answer

Deploy a single Microsoft Sentinel workspace and use data collection rules to filter logs

Question 7

Your organization uses Microsoft Defender for Cloud to monitor Azure SQL databases. You receive an alert indicating a potential SQL injection attack. What is the most effective immediate action to validate and respond?

Accepted Answer

Review the SQL database auditing logs to identify the source queries. Option C is correct because the SQL database auditing records show the actual queries, allowing validation. Option A is wrong because enabling TDE does not help validate an attack. Option B is wrong because vulnerability assessments are not real-time. Option D is wrong because firewall rules may block legitimate traffic.

Answer

Enable Transparent Data Encryption (TDE) on the database

Answer

Run a vulnerability assessment on the database

Answer

Immediately block all IP addresses from the alert in the SQL firewall

Question 8

Your organization is migrating to Azure and needs to protect against advanced threats like fileless malware. You must use a solution that provides real-time protection and integrates with Microsoft Defender for Cloud. What should you deploy on Azure VMs?

Accepted Answer

Microsoft Defender for Endpoint (Microsoft Defender XDR). Option B is correct because Microsoft Defender for Endpoint (now part of Defender XDR) provides real-time protection and integrates with Defender for Cloud. Option A is wrong because AMA is an agent, not a security solution. Option C is wrong because Microsoft Antimalware does not cover fileless malware. Option D is wrong because Azure Security Center is the same as Defender for Cloud, not an endpoint protection.

Answer

Microsoft Antimalware for Azure

Answer

Azure Monitor Agent (AMA)

Answer

Azure Security Center (free tier)

Question 9

You need to ensure that security alerts from Microsoft Defender for Cloud are sent to a central SIEM system. What should you configure?

Accepted Answer

Enable continuous export to Event Hubs. Option A is correct because continuous export allows streaming alerts to Event Hubs for integration with SIEMs. Option B is wrong because diagnostic settings are for logs, not alerts. Option C is wrong because playbooks are for response, not export. Option D is wrong because Azure Policy is for governance.

Answer

Create a playbook that forwards alerts to the SIEM

Answer

Configure diagnostic settings for the subscription

Answer

Assign an Azure Policy to export alerts

Question 10

Which TWO of the following are valid ways to integrate Microsoft Sentinel with Microsoft Defender XDR?

Accepted Answer

Configure the Microsoft Defender XDR data connector. Options A and C are correct. Option A is correct because the data connector for Microsoft Defender XDR ingests alerts. Option C is correct because enabling automatic incident creation in the connector creates incidents. Option B is wrong because playbooks are for automation, not integration. Option D is wrong because cross-tenant integration requires Lighthouse. Option E is wrong because custom logs do not integrate automatically.

Answer

Use Azure Lighthouse to connect Defender XDR to Sentinel

Answer

Deploy a playbook that polls Defender XDR APIs

Answer

Create a custom log analytics workspace query

Question 11

Which THREE of the following are capabilities of Microsoft Defender for Cloud's workload protection plans?

Accepted Answer

Adaptive application controls. Options A, B, and D are correct. Option A is correct because Just-in-time VM access is a feature. Option B is correct because file integrity monitoring is included. Option D is correct because adaptive application controls are part of workload protection. Option C is wrong because DDoS protection is a separate service. Option E is wrong because data loss prevention is part of Microsoft Purview.

Answer

DDoS protection

Answer

Data Loss Prevention (DLP)

Question 12

Which TWO of the following are valid data connectors in Microsoft Sentinel?

Accepted Answer

Azure Active Directory (Microsoft Entra ID). Options A and D are correct. Option A is correct because Amazon Web Services S3 connector is available. Option D is correct because Azure Active Directory (now Microsoft Entra ID) connector is available. Option B is wrong because there is no direct connector for Google Cloud Platform; it requires a custom solution. Option C is wrong because Microsoft SQL Server connector does not exist directly; it uses Windows Event Forwarding. Option E is wrong because VMware vCenter connector is not a built-in connector.

Answer

Microsoft SQL Server

Answer

Google Cloud Platform

Answer

VMware vCenter

Question 13

You are a security engineer for a company that uses Microsoft Defender for Cloud with the CSPM (Cloud Security Posture Management) plan enabled. You need to ensure that all Azure subscriptions are assessed against the Microsoft Cloud Security Benchmark (MCSB). Which action should you take?

Accepted Answer

No action needed; MCSB is the default security policy assigned to all subscriptions.. Option D is correct because the default initiative assigned to all subscriptions in Defender for Cloud is the Microsoft Cloud Security Benchmark (MCSB). Option A is wrong because the CIS benchmark is a different standard and not the default. Option B is wrong because standards are assigned at the subscription level, not management group. Option C is wrong because regulatory compliance is a separate feature and does not replace the default benchmark.

Answer

Assign the CIS Microsoft Azure Foundations Benchmark initiative to each subscription.

Answer

Assign the MCSB initiative at the management group level.

Answer

Enable regulatory compliance standards in Defender for Cloud.

Question 14

Your company has Microsoft Sentinel deployed in multiple workspaces across several Azure regions. The security operations team wants to query data from all workspaces centrally using a single KQL query. What feature should you implement?

Accepted Answer

Use cross-workspace queries with the workspace() expression in KQL.. Option B is correct because cross-workspace queries in Sentinel allow running a single KQL query across multiple workspaces. Option A is wrong because Log Analytics workspaces are the data stores, not a query method across workspaces. Option C is wrong because Azure Data Explorer is not integrated natively for this purpose. Option D is wrong because the SIEM connector is for data ingestion, not for cross-workspace querying.

Answer

Configure Log Analytics workspaces as linked to a central workspace.

Answer

Export all data to Azure Data Explorer and query there.

Answer

Use the Microsoft Sentinel SIEM connector to aggregate data.

Question 15

You are configuring Microsoft Defender for Cloud to protect your Azure virtual machines. You need to enable just-in-time (JIT) VM access to reduce the attack surface. What prerequisite must be met?

Accepted Answer

Enable Microsoft Defender for Servers Plan 2.. Option C is correct because JIT VM access requires Microsoft Defender for Servers Plan 2. Option A is wrong because there is no 'JIT' plan in Defender for Cloud. Option B is wrong because Azure Bastion is a separate service for secure remote access, not a prerequisite. Option D is wrong because Microsoft Defender for Cloud Apps is for SaaS applications, not VMs.

Answer

Configure Microsoft Defender for Cloud Apps with the VMs as connected.

Answer

Enable the Defender for Cloud 'JIT' plan.

Answer

Deploy Azure Bastion in the same virtual network.