AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 6 — 15 Questions

Question 1

You are configuring Microsoft Sentinel to detect a new type of ransomware that encrypts files and changes file extensions. You need to create a detection rule that generates an incident when the same pattern of file changes occurs on multiple hosts within a short time. Which rule type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NRT (Near-Real-Time) query rule.. D is correct because NRT (Near-Real-Time) query rules in Microsoft Sentinel are designed to detect patterns across multiple hosts within a short time window (typically 1–5 minutes) by running queries every minute and evaluating results against a threshold. This matches the requirement to generate an incident when the same file-change pattern occurs on multiple hosts rapidly, as NRT rules can aggregate events across hosts and trigger on a count threshold.

Answer

Microsoft Security incident creation rule (ML behavior analytics).

Answer

Scheduled query rule.

Answer

Fusion rule (advanced multistage attack detection).

Question 2

Your security team wants to use Microsoft Sentinel to investigate a compromised user account. They need to see the user's recent sign-in activity, Azure AD audit logs, and related alerts in a single dashboard. What feature in Sentinel should they use?

Accepted Answer

Use the Investigation graph to visually explore the user's activities.. The Investigation graph in Microsoft Sentinel is specifically designed for security operations to visually explore and correlate activities related to a compromised entity, such as a user account. It automatically pulls in sign-in logs, Microsoft Entra ID audit logs, and related alerts into a single interactive graph, allowing analysts to trace the scope of an incident without manual querying. This makes it the correct feature for the described need of a unified dashboard for investigation.

Answer

Create a workbook that queries sign-in logs and audit logs.

Answer

Navigate to the user's entity page in Sentinel.

Answer

Create an analytics rule to detect user anomalies.

Question 3

You are a security engineer for a multinational company with 5000 Azure VMs across multiple subscriptions. You have deployed Microsoft Sentinel to ingest logs from all VMs via the Log Analytics agent. You need to create a detection rule that identifies potential cryptocurrency mining activity based on network traffic patterns. The rule should trigger an incident when any single VM communicates with a known mining pool IP address over port 3333, 4444, or 8333 within a 5-minute window. Additionally, to reduce noise, the rule should only trigger if the same VM sends more than 10 such connections in that window. You have a custom KQL function that extends the CommonSecurityLog table with an 'IsMiningPool' boolean column. Which of the following approaches should you use to create the rule?

Accepted Answer

Use a scheduled query rule with the query: CommonSecurityLog | where IsMiningPool == true | summarize ConnectionCount = count() by SourceIP, DestinationPort | where ConnectionCount > 10.. It uses the custom 'IsMiningPool' function to filter traffic to known mining pools, then summarizes the count of connections per source IP and destination port, and applies a threshold of >10 connections. This matches the requirement: detect when a single VM communicates with a mining pool IP on the specified ports more than 10 times in a 5‑minute window. Option A is wrong because it does not use the custom function and only filters by destination ports, which would include non‑mining traffic. Option B is wrong because it counts unique destination IPs instead of total connections. Option D is wrong because it uses NRT (near‑real‑time) rule, which is not appropriate for an aggregation over a time window, and the syntax is invalid.

Answer

Use a scheduled query rule with the query: CommonSecurityLog | where DestinationPort in (3333,4444,8333) | summarize ConnectionCount = count() by SourceIP | where ConnectionCount > 10.

Answer

Use a scheduled query rule with the query: CommonSecurityLog | where IsMiningPool == true | summarize UniqueDestIPs = dcount(DestinationIP) by SourceIP | where UniqueDestIPs > 10.

Answer

Use an NRT query rule with the query: CommonSecurityLog | where IsMiningPool == true | where count() > 10.

Question 4

Your organization uses Microsoft Defender for Cloud to secure a multi-subscription environment. You have a subscription named 'Prod' that hosts critical applications. The security team requires that any new resource group created in the Prod subscription must automatically be protected by Microsoft Defender for Cloud at the 'Defender for Servers' plan P2 level. You need to implement a solution that ensures this compliance without manual intervention. You consider using Azure Policy, Azure Blueprints, or management group settings. Which option should you choose?

Accepted Answer

Use a management group structure where the 'Prod' subscription is under a 'Production' management group, and enable the 'Defender for Servers' plan P2 at the management group level.. Enabling 'Defender for Servers' plan P2 at the management group level applies to all subscriptions under that management group, including the 'Prod' subscription. This setting is inherited by new resource groups automatically, ensuring compliance without manual intervention. Option A is incorrect because Azure Blueprints are deprecated in favor of deployment stacks and do not automatically apply to new resource groups created after assignment. Option B is incorrect because tagging and automation runbooks require custom development and are not a standard compliance enforcement method; they also do not guarantee automatic protection for new resource groups. Option C is incorrect because while Azure Policy can deploy the plan via a DeployIfNotExists policy, it would need to be assigned at the subscription scope, not at the resource group scope, and management group inheritance is a more straightforward and built-in solution.

Answer

Create an Azure Blueprint that includes the 'Defender for Servers' plan P2 assignment and assign it to the 'Prod' subscription.

Answer

Use Azure Resource Manager tags on resource groups to indicate 'ProtectionRequired', and configure a custom automation runbook to enable the plan.

Answer

Create an Azure Policy definition that deploys the 'Defender for Servers' plan P2 and assign it to the 'Prod' subscription with scope 'resource group'.

Question 5

Your organization uses Microsoft Defender for Cloud to secure a multi-cloud environment that includes Azure, AWS, and GCP resources. You need to ensure that all resources are assessed against a consistent set of security standards. What should you configure first?

Accepted Answer

In Defender for Cloud, add a regulatory compliance standard such as 'Azure CIS 1.4.0' and enable continuous export for all connected clouds.. Defender for Cloud's regulatory compliance dashboard is the central place where security standards are applied and assessed across all connected clouds. Adding a standard like 'Azure CIS 1.4.0' ensures that the same set of controls is evaluated for Azure, AWS, and GCP resources, and continuous export allows you to stream the compliance data to other systems for reporting or SIEM ingestion. This is the first configuration step because it establishes the consistent assessment baseline before any other integration or automation.

Answer

Connect the AWS and GCP accounts to AWS Security Hub and Google Security Command Center respectively, then enable Defender for Cloud's multicloud connector.

Answer

Create Azure Policy initiatives and assign them to the management groups that contain the multicloud resources.

Answer

Configure Microsoft Sentinel to ingest security findings from AWS and GCP, then create custom alerts for compliance deviations.

Question 6

Refer to the exhibit. You are reviewing a custom Azure Policy definition that will be assigned to a subscription to audit storage accounts and Cosmos DB accounts. The policy is intended to check whether these resources use customer-managed keys (CMK) for encryption. However, when you test the policy assignment, it does not evaluate Cosmos DB accounts. What is the most likely reason?

Accepted Answer

The existence condition in 'auditIfNotExists' only checks for storage account encryption; it does not evaluate Cosmos DB encryption properties.. The policy definition uses an 'auditIfNotExists' effect, which requires an existence condition to check for a specific resource (e.g., encryption settings). The existence condition in the policy only references 'Microsoft.Storage/storageAccounts' and their encryption properties, so it does not evaluate Cosmos DB accounts. Even if the 'if' condition matches Cosmos DB, the 'auditIfNotExists' effect will not trigger because the existence condition is not defined for Cosmos DB encryption properties.

Answer

The policy rule only includes 'Microsoft.Storage/storageAccounts' in the if condition; Cosmos DB is not evaluated because the policy definition is incomplete.

Answer

The policy mode is set to 'All', which excludes Cosmos DB resources.

Answer

Cosmos DB does not support customer-managed keys; the policy cannot be applied to that resource type.

Question 7

Your security team has deployed Microsoft Sentinel. They need to create an analytics rule that uses a custom KQL query to detect failed logon attempts from a specific IP address range and automatically creates an incident with a severity of 'High'. Which rule type should they use?

Accepted Answer

Scheduled query rule. A Scheduled query rule in Microsoft Sentinel allows you to define a custom KQL query that runs at a specified interval, evaluate the results against a threshold, and automatically create an incident with a configurable severity. This is the only rule type that supports custom KQL queries for detecting specific patterns like failed logons from a given IP range and mapping them to a 'High' severity incident.

Answer

Anomaly rule

Answer

NRT (Near-Real-Time) analytics rule

Answer

Fusion rule

Question 8

Your organization uses Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) to assess security posture. You notice that a critical recommendation for enabling diagnostic logs on Azure Key Vault is not appearing for a specific subscription. You have confirmed that the subscription is onboarded to Defender for Cloud. What is the most likely cause?

Accepted Answer

The subscription is not enrolled in the Defender Cloud Security Posture Management (CSPM) plan.. The CSPM plan must be explicitly enabled at the subscription level in Defender for Cloud. Even if the subscription is onboarded to Defender for Cloud, the CSPM plan (formerly 'Defender for Cloud Security Posture Management') is a separate plan that must be enrolled. Without it, CSPM recommendations—including the one for enabling diagnostic logs on Key Vault—will not be generated, as CSPM is the engine that evaluates and surfaces those posture recommendations.

Answer

The Log Analytics workspace linked to Defender for Cloud does not contain the Key Vault diagnostics schema.

Answer

Diagnostic logs are disabled by default in the Azure subscription's activity log settings.

Answer

Key Vault does not support diagnostic logs; therefore, the recommendation is not applicable.

Question 9

Refer to the exhibit. You assign this built-in policy to a resource group containing Linux VMs. The policy is intended to deploy the Log Analytics agent if it is missing. After the assignment, you notice that the policy does not evaluate any VMs and the compliance state is 'Not started'. What is the most likely reason?

Accepted Answer

The policy mode 'Indexed' requires a remediation task to be created; the policy only evaluates resources when a remediation task is triggered.. The built-in policy 'Deploy Log Analytics agent for Linux VMs' uses the 'Indexed' resource provider mode, which only evaluates compliance when a remediation task is triggered. Without creating a remediation task, the policy remains in 'Not started' state and never evaluates the VMs. This is a common behavior for policies that deploy extensions via 'deployIfNotExists' effect.

Answer

The policy parameter 'workspaceId' is not provided during assignment.

Answer

Built-in policies cannot be assigned directly to a resource group; they must be assigned to a management group.

Answer

The Log Analytics agent is already installed on all VMs.

Question 10

Your organization is using Microsoft Sentinel to centralize security data from multiple sources. You need to ensure that data from Azure Active Directory (now Microsoft Entra ID) logs is ingested. Which two of the following should you configure? (Choose two.)

Accepted Answer

Configure diagnostic settings in Microsoft Entra ID to stream audit and sign-in logs to a Log Analytics workspace.. Option B is correct because Microsoft Entra ID (formerly Azure AD) audit logs, sign-in logs, and other diagnostic data are exported to a Log Analytics workspace through the diagnostic settings feature, which is the underlying mechanism that feeds the workspace Sentinel is attached to. Option D is correct because the Microsoft Entra ID data connector in Microsoft Sentinel is the connector designed to ingest Entra ID sign-in logs, audit logs, and (with the appropriate licensing) non-interactive user and risk event logs into the Sentinel workspace. Together, the connector and diagnostic settings ensure Entra ID log data flows into Sentinel for analytics and detection. Option A is incorrect because the Microsoft 365 Defender connector ingests alerts and incidents from Defender services (such as Defender for Endpoint, Identity, and Office 365), not the raw Entra ID audit and sign-in logs. Option C is incorrect because creating a separate workspace is unnecessary and actually counterproductive, since Sentinel ingests data into the workspace it is deployed on. Option E is incorrect because the Log Analytics agent (MMA/AMA) is used to collect Windows event and syslog data from machines such as domain controllers, not to ingest Entra ID cloud logs.

Answer

Enable the Microsoft 365 Defender data connector in Sentinel.

Answer

Create a separate Log Analytics workspace for Microsoft Entra ID logs.

Answer

Install the Log Analytics agent on domain controllers.

Question 11

Your company is implementing Microsoft Defender for Cloud's Security Alerts. You need to ensure that alerts for critical severity are automatically sent to the security operations team via email and also create a ticket in ServiceNow. Which three actions should you take? (Choose three.)

Accepted Answer

Create a continuous export rule in Defender for Cloud to send alerts to an Event Hubs namespace.. Option C is correct because a continuous export rule in Microsoft Defender for Cloud can stream security alerts to an Event Hubs namespace, which provides the event-driven integration point needed to route critical alerts to external systems such as ServiceNow. Option D is correct because an Azure Logic App can be configured with an Event Hubs trigger to consume the exported alerts and then use the ServiceNow connector to create a ticket automatically. Option E is correct because Defender for Cloud's security contacts settings include email notifications, and configuring them for high-severity alerts ensures the security operations team receives critical alert emails. Option A is not required because Microsoft Sentinel playbooks are automation rules within Sentinel, and the scenario does not state that Sentinel is deployed or that alerts originate from Sentinel. Option B is not required because the Log Analytics agent (or Azure Monitor Agent) is used for data collection from VMs, not for configuring alert email delivery or ServiceNow ticket creation.

Answer

Create a playbook in Microsoft Sentinel that triggers on alerts.

Answer

Install the Log Analytics agent on all VMs to collect security alerts.

Question 12

Your company is using Microsoft Sentinel for security operations. You need to create a threat intelligence (TI) feed that allows Sentinel to match indicators from an external source. Which three actions should you take? (Choose three.)

Accepted Answer

Upload threat intelligence indicators using the Threat Intelligence API or portal.. Option C is correct because Microsoft Sentinel ingests STIX-formatted threat indicators either through the Microsoft Graph Security tiIndicators API or by uploading them in the Sentinel portal (Threat intelligence blade), which is the foundational step to make indicators available for matching. Option D is correct because the Threat Intelligence - TAXII data connector is the built-in mechanism for pulling indicators from an external TAXII 2.0/2.1 server, which is exactly what an external TI feed scenario requires. Option E is correct because simply ingesting indicators does not generate detections; you must create a scheduled analytics rule that uses the Threat Intelligence indicator mapping (for example, matching IP/domain/file hash entity mappings against the Microsoft Sentinel TI tables) so Sentinel produces alerts when events match those indicators. Option A is not correct because watchlists are for custom lookup data such as VIP lists or allowlists, not for ingesting STIX threat indicators from an external feed. Option B is not correct because Fusion correlates multiple low-fidelity signals into incidents and does not perform TI indicator matching against log data.

Answer

Create a watchlist containing the indicators.

Answer

Enable the Fusion rule to correlate TI indicators with other events.

Question 13

Your company has a Microsoft Sentinel workspace that ingests logs from multiple sources, including Azure Active Directory (now Microsoft Entra ID), Azure Firewall, and Microsoft 365 Defender. You are asked to create an analytics rule that detects when a user account is deleted from Microsoft Entra ID and then, within 24 hours, a large number of Azure resources are deleted in the same tenant. You have the following requirements: - The rule must use KQL to correlate events across two tables: AuditLogs (for user deletion) and ActivityLogs (for resource deletion). - The rule should trigger an incident only if more than 10 resources are deleted within 24 hours after the user deletion. - The incident severity should be set to 'High'. - The rule should run every hour and look back 24 hours. Which of the following is the correct KQL query for the analytics rule? (Choose the best option.)

Accepted Answer

let deletionTime = AuditLogs | where OperationName == 'Delete user' | project DeletionTime = TimeGenerated, UserPrincipalName; deletionTime | join kind=inner (ActivityLogs | where OperationName == 'Delete resource') on UserPrincipalName | where ActivityLogs_TimeGenerated between (DeletionTime .. DeletionTime + 24h) | summarize ResourceCount = count() by UserPrincipalName | where ResourceCount > 10. It uses a 'let' statement to capture the user deletion time and UserPrincipalName, then joins with ActivityLogs filtered for 'Delete resource' operations on UserPrincipalName. The 'where' clause with 'between' ensures resource deletions are counted only if they occur within 24 hours after the user deletion. Finally, it summarizes the count of resource deletions per user and triggers an incident only if the count exceeds 10. Option A is incorrect because after the join, the TimeGenerated column is ambiguous (both tables have it), and the join key UserPrincipalName may not match in both tables. Option B is incorrect because it does not filter ActivityLogs for 'Delete resource' operations and uses a non-standard time condition that may not enforce the 24-hour window correctly. Option C is incorrect because the time condition 'TimeGenerated + 24h > ActivityLogs_TimeGenerated' only checks that resource deletions occur within 24 hours before the user deletion, not after, and it summarizes by Caller instead of UserPrincipalName, which may not correctly correlate the events.

Answer

Answer

AuditLogs | where OperationName == 'Delete user' | join kind=inner (ActivityLogs) on $left.Caller == $right.Caller | where TimeGenerated < ActivityLogs_TimeGenerated and TimeGenerated + 24h > ActivityLogs_TimeGenerated | summarize ResourceCount = count() by UserPrincipalName | where ResourceCount > 10

Answer

Question 14

Your organization uses Microsoft Sentinel to monitor for data exfiltration. You have configured a scheduled analytics rule that detects when an external IP address downloads more than 100 MB of data from an Azure Storage account within 5 minutes. The rule triggers, but the incident created has a severity of 'Low', while your team wants it to be 'High' for all such incidents. What should you do?

Accepted Answer

Edit the analytics rule and change the 'Severity' setting to 'High' in the 'Incident settings' tab.. The severity of an incident generated by a scheduled analytics rule is directly controlled by the 'Severity' setting within the rule's 'Incident settings' tab. By editing the rule and changing this setting from 'Low' to 'High', all future incidents triggered by that rule will automatically be created with 'High' severity, which is the simplest and most direct solution.

Answer

Create a playbook that changes the severity of incidents created by that rule and attach it via an automation rule.

Answer

Add an entity mapping for the storage account so that the severity is inherited from the entity.

Answer

Create an automation rule that triggers on incident creation and sets the severity to 'High' for all incidents from that rule.

Question 15

Your company has a Microsoft Sentinel workspace that ingests logs from Azure AD, Azure Activity, and Azure Firewall. You are investigating an incident where an attacker gained access to a user's credentials and logged in from an unusual location. The sign-in log shows that the user passed MFA. You suspect that the attacker might have used a phishing attack to bypass MFA. Which Microsoft 365 Defender feature should you enable to detect such attacks?

Accepted Answer

Microsoft 365 Defender's Attack simulation training.. Attack simulation training in Microsoft 365 Defender allows you to create and run realistic phishing campaigns to test your users' susceptibility to phishing attacks. By simulating a phishing attempt that bypasses MFA, you can identify vulnerable users and train them to recognize and report such attacks, directly addressing the scenario where an attacker used phishing to bypass MFA.

Answer

Microsoft Defender for Office 365's anti-phishing policies.

Answer

Microsoft Entra Conditional Access policies with session control.

Answer

Microsoft Entra Identity Protection with user risk policy.