AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 6 — 15 Questions

Question 1

Your security team receives a high-priority alert from Microsoft Sentinel indicating a potential brute-force attack against an Azure SQL Database. The alert was generated by an analytics rule using the following KQL query: 'SigninLogs | where ResultType == "50057" | summarize Count = count() by UserPrincipalName, IPAddress | where Count > 10'. What is the most likely cause of the alert?

Accepted Answer

Multiple sign-in attempts using a disabled account from the same IP address.. Option B is correct because ResultType 50057 indicates 'User account is disabled', so the alert is triggered when a disabled account has more than 10 sign-in attempts from the same IP. Option A is wrong because MFA failure is a different result type. Option C is wrong because the query does not check if the user is enabled. Option D is wrong because the query specifically targets a disabled account, not a non-existent one.

Answer

Multiple failed MFA attempts by a user.

Answer

A user successfully signed in after many attempts.

Answer

Multiple sign-in attempts from a non-existent user account.

Question 2

You are designing a Microsoft Sentinel deployment for a multinational company. The company requires that data from different geographic regions be stored separately to comply with data residency laws. What is the recommended approach?

Accepted Answer

Deploy a separate Microsoft Sentinel workspace in each required region.. Option A is correct because to comply with data residency, you need separate Sentinel workspaces per region. Option B is wrong because Sentinel does not support data-level routing to different storage locations within a single workspace. Option C is wrong because using a single workspace with diagnostic settings does not separate storage. Option D is wrong because Azure Purview is for data governance, not storage.

Answer

Deploy a single Sentinel workspace and use Azure Purview to tag data for residency.

Answer

Deploy a single Sentinel workspace and configure diagnostic settings to send data to separate Log Analytics workspaces.

Answer

Deploy a single Sentinel workspace and use data collection rules to route data to different storage accounts.

Question 3

You need to configure a continuous export of Microsoft Defender for Cloud alerts to a third-party SIEM. Which feature should you use?

Accepted Answer

Use the continuous export feature in Defender for Cloud to stream alerts to an Event Hubs namespace.. Option C is correct because continuous export in Defender for Cloud can stream alerts to Event Hubs, which can be consumed by a SIEM. Option A is wrong because Azure Monitor agent is for collecting logs, not exporting alerts. Option B is wrong because Logic Apps can be used but are not the primary built-in method. Option D is wrong because API integration requires custom development.

Answer

Create an Azure Logic App to periodically query and send alerts.

Answer

Use the Defender for Cloud REST API to pull alerts.

Answer

Configure Azure Monitor agent on all VMs.

Question 4

Your company uses Microsoft Sentinel to monitor Azure resources. A new analytics rule is created to detect anomalous access to storage accounts. The rule runs every 5 minutes and looks at the last 15 minutes of data. After deploying, the rule generates no alerts even though you suspect there are anomalies. What is the most likely issue?

Accepted Answer

The rule query logic is incorrect or the entities are not properly mapped.. Option B is correct because the query runs every 5 minutes looking at 15 minutes of data, so there is overlap and data should be captured; however, the rule may be misconfigured with an incorrect query or entities. Option A is wrong because the query frequency and data lookback are compatible. Option C is wrong because the rule is enabled. Option D is wrong because rule severity does not affect alert generation.

Answer

The rule is not enabled.

Answer

The rule severity is set too low.

Answer

The rule query frequency is longer than the data lookback period.

Question 5

You are responsible for securing Azure resources using Microsoft Defender for Cloud. You receive a recommendation that your Azure Kubernetes Service (AKS) cluster has a vulnerability in a container image. The recommendation is labeled 'Container images should be scanned for vulnerabilities'. What action should you take to remediate this recommendation?

Accepted Answer

Rebuild the container image using an updated base image and redeploy.. Option A is correct because the recommendation indicates vulnerabilities found by Defender for Containers. Remediation involves updating the base image and rebuilding the container. Option B is wrong because turning off the scanner does not fix the vulnerability. Option C is wrong because the recommendation is not about Defender for Cloud Apps. Option D is wrong because the recommendation is already enabled; you need to fix the image.

Answer

Enable the 'Vulnerability assessment solutions should be enabled on your VMs' recommendation.

Answer

Enable Microsoft Defender for Cloud Apps for the AKS cluster.

Answer

Disable the vulnerability scanner for that repository.

Question 6

Your organization wants to use Microsoft Sentinel to automatically respond to high-severity incidents. Which feature should you configure?

Accepted Answer

Create an automation rule that triggers a playbook on incident creation.. Option B is correct because automation rules in Sentinel can trigger playbooks or other responses automatically based on incident conditions. Option A is wrong because analytic rules generate alerts, not automated responses. Option C is wrong because workbooks are for visualization. Option D is wrong because entity behavior analytics is for detection, not response.

Answer

Create an analytics rule with a high severity.

Answer

Create a workbook to visualize incidents.

Answer

Enable entity behavior analytics.

Question 7

Which TWO of the following are valid methods to ingest data into Microsoft Sentinel? (Select two.)

Accepted Answer

Using the Log Analytics agent to send custom logs.. Options B and D are correct. A connector is the standard way to ingest data from various sources. Custom logs using Log Analytics agents is also a valid method. Option A is wrong because PowerShell cmdlets do not directly ingest data into Sentinel. Option C is wrong because Azure Policy can enforce compliance but not ingest data. Option E is wrong because Power BI is a visualization tool, not data ingestion.

Answer

Using the Azure PowerShell cmdlets to send events directly.

Answer

Using Power BI to stream data.

Answer

Using Azure Policy to forward logs.

Question 8

Which THREE of the following are capabilities of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) plan? (Select three.)

Accepted Answer

Continuous assessment of security configurations.. Options B, C, and D are correct. CSPM provides security recommendations, continuous assessment, and a secure score. Option A is wrong because file integrity monitoring is part of Defender for Servers, not CSPM. Option E is wrong because JIT VM access is part of Defender for Servers Plan 2.

Answer

Just-in-time (JIT) VM access.

Answer

File Integrity Monitoring (FIM).

Question 9

Which TWO of the following are valid data sources for Microsoft Sentinel's UEBA (User and Entity Behavior Analytics)? (Select two.)

Accepted Answer

Microsoft Entra ID sign-in logs.. Options A and D are correct. Azure Active Directory (now Microsoft Entra ID) sign-in logs and audit logs are key sources for UEBA. Option B is wrong because Azure Activity Logs are for resource operations, not user behavior. Option C is wrong because Azure SQL Database audit logs are not a default source for UEBA. Option E is wrong because Azure Firewall logs are network logs, not user behavior.

Answer

Azure SQL Database audit logs.

Answer

Azure Activity Logs.

Answer

Azure Firewall logs.

Question 10

Your organization uses Microsoft Defender for Cloud to protect Azure workloads. You notice that a critical Azure VM is not covered by any of the Defender for Cloud plans. You need to ensure that the VM is protected by the Defender for Servers plan. What should you do?

Accepted Answer

Enable the Defender for Servers plan in the Defender for Cloud environment settings for the subscription containing the VM.. Option A is correct because to enable Defender for Servers on a specific subscription, you configure the Defender for Cloud environment settings at the subscription level. Option B is wrong because enabling on the VM itself is not directly supported; the plan must be enabled at the subscription or resource group level. Option C is wrong because the plan covers supported OS types. Option D is wrong because the plan covers Azure VMs, not just on-premises.

Answer

Create a custom Azure Policy to assign the Defender for Servers plan to the VM.

Answer

Enable the Defender for Servers plan directly on the VM's security configuration blade.

Answer

Ensure the VM is running a supported operating system; the plan is automatically enabled for all VMs.

Question 11

Your security team uses Microsoft Sentinel to detect threats. You need to set up a rule that triggers an alert when a user account is created in Microsoft Entra ID. Which rule type should you configure?

Accepted Answer

Scheduled query rule. Option B is correct because Scheduled query rules run periodically on log data. Option A is wrong because NRT rules are for near-real-time detection but are more suitable for data arriving in a stream. Option C is wrong because Fusion is for advanced multistage attacks. Option D is wrong because Anomaly rules use machine learning to detect unusual patterns, not specific events.

Answer

Near-Real-Time (NRT) rule

Answer

Anomaly rule

Answer

Fusion rule

Question 12

Your organization has multiple Azure subscriptions and uses Microsoft Defender for Cloud. You need to ensure that all subscriptions have a consistent security policy applied. You create a management group containing all subscriptions. What should you do next to assign a Defender for Cloud initiative to all subscriptions?

Accepted Answer

Assign the initiative as an Azure Policy at the management group scope.. Option C is correct because Azure Policy can be assigned at the management group level to inherit to all child subscriptions. Option A is wrong because Defender for Cloud initiatives are not assigned per subscription manually. Option B is wrong because Azure Blueprints are deprecated. Option D is wrong because assigning at the tenant root would apply to all tenants, not recommended.

Answer

Use Azure Blueprints to define the initiative and assign it to the management group.

Answer

Create a custom RBAC role that includes the initiative and assign it to the management group.

Answer

Assign the initiative to each subscription individually using the Defender for Cloud interface.

Question 13

Refer to the exhibit. You are evaluating an Azure Policy definition that enables Defender for Cloud on a subscription. The policy uses 'DeployIfNotExists' effect. Which role must be assigned to the managed identity used by this policy to successfully deploy the pricing resource?

Accepted Answer

Security Admin. Option A is correct because to create or update Microsoft.Security/pricings resources, the managed identity needs 'Security Admin' role (which includes Microsoft.Security/pricings/write). Option B is wrong because Contributor has broader permissions but not specifically the needed security write. Option C is wrong because Reader cannot write. Option D is wrong because Owner is too broad and not best practice.

Answer

Owner

Answer

Reader

Answer

Contributor

Question 14

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). You need to investigate a possible insider threat where a user is accessing sensitive data from unusual locations. Which Sentinel feature should you use to visualize the user's activities and related entities?

Accepted Answer

UEBA investigation insights and entity pages. Option D is correct because UEBA provides investigation insights and entity pages that show user activities and related entities. Option A is wrong because Workbooks are for custom dashboards. Option B is wrong because Hunting queries are for proactive searches. Option C is wrong because Analytics rules are for alert creation.

Answer

Hunting queries

Answer

Analytics rules

Answer

Workbooks

Question 15

Your company has a hybrid environment with on-premises servers and Azure VMs. You want to use Microsoft Defender for Cloud to assess the security posture of both environments. What do you need to install on the on-premises servers to enable Defender for Cloud monitoring?

Accepted Answer

Azure Arc agent. Option A is correct because Azure Arc enables non-Azure machines to be managed by Azure and monitored by Defender for Cloud. Option B is wrong because the MMA is legacy and being replaced by Azure Monitor Agent. Option C is wrong because the Log Analytics agent is similar to MMA. Option D is wrong because the Azure Security Center agent is not a standalone agent.

Answer

Microsoft Monitoring Agent (MMA)

Answer

Azure Security Center agent

Answer

Log Analytics agent