AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 6 — 15 Questions

Question 1

Which TWO of the following are valid data sources for Microsoft Sentinel's UEBA (User and Entity Behavior Analytics)? (Select two.)

Accepted Answer

Microsoft Entra ID sign-in logs.. Options A and B are correct. Microsoft Entra ID sign-in logs and audit logs are key data sources for UEBA in Microsoft Sentinel, as they provide user authentication and directory activity insights. Option C (Azure SQL Database audit logs) is not a default UEBA source. Option D (Azure Activity Logs) tracks resource operations, not user behavior, and is not used for UEBA. Option E (Azure Firewall logs) are network logs, not relevant for UEBA.

Answer

Azure SQL Database audit logs.

Answer

Azure Activity Logs.

Answer

Azure Firewall logs.

Question 2

Your organization uses Microsoft Defender for Cloud to protect Azure workloads. You notice that a critical Azure VM is not covered by any of the Defender for Cloud plans. You need to ensure that the VM is protected by the Defender for Servers plan. What should you do?

Accepted Answer

Enable the Defender for Servers plan in the Defender for Cloud environment settings for the subscription containing the VM.. Defender for Cloud plans are enabled at the subscription level, not per resource. By enabling the Defender for Servers plan in the Defender for Cloud environment settings for the subscription containing the VM, all current and future VMs in that subscription will be automatically protected, including the critical VM in question.

Answer

Create a custom Azure Policy to assign the Defender for Servers plan to the VM.

Answer

Enable the Defender for Servers plan directly on the VM's security configuration blade.

Answer

Ensure the VM is running a supported operating system; the plan is automatically enabled for all VMs.

Question 3

Your security team uses Microsoft Sentinel to detect threats. You need to set up a rule that triggers an alert when a user account is created in Microsoft Entra ID. Which rule type should you configure?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) to detect specific events like user account creation in Microsoft Entra ID (Azure AD). This rule type is designed for custom detection scenarios where you need to match exact log patterns, such as the AuditLogs event 'Add user', and trigger an alert based on the results.

Answer

Near-Real-Time (NRT) rule

Answer

Anomaly rule

Answer

Fusion rule

Question 4

Refer to the exhibit. You are evaluating an Azure Policy definition that enables Defender for Cloud on a subscription. The policy uses 'DeployIfNotExists' effect. Which role must be assigned to the managed identity used by this policy to successfully deploy the pricing resource?

Accepted Answer

Security Admin. The DeployIfNotExists effect in Azure Policy requires a managed identity with sufficient permissions to remediate non-compliant resources. For enabling Defender for Cloud pricing, the managed identity needs to create or update the 'pricings' resource under Microsoft.Security, which requires the Security Admin role. This role grants the necessary write permissions to configure security pricing tiers without the broader privileges of Owner or Contributor.

Answer

Owner

Answer

Reader

Answer

Contributor

Question 5

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). You need to investigate a possible insider threat where a user is accessing sensitive data from unusual locations. Which Sentinel feature should you use to visualize the user's activities and related entities?

Accepted Answer

UEBA investigation insights and entity pages. UEBA in Microsoft Sentinel provides investigation insights and entity pages that aggregate user activities, related entities, and behavioral anomalies into a visual timeline. This allows you to see a user's access patterns from unusual locations and correlate them with other entities like devices or IP addresses, making it the correct feature for investigating insider threats.

Answer

Hunting queries

Answer

Analytics rules

Answer

Workbooks

Question 6

Your company has a hybrid environment with on-premises servers and Azure VMs. You want to use Microsoft Defender for Cloud to assess the security posture of both environments. What do you need to install on the on-premises servers to enable Defender for Cloud monitoring?

Accepted Answer

Azure Arc agent. Azure Arc agent is the correct choice because it extends Azure Resource Manager (ARM) management to non-Azure machines, including on-premises servers. Once the Azure Arc agent is installed, the on-premises server becomes a 'hybrid machine' resource in Azure, enabling Defender for Cloud to assess its security posture using the same policies and vulnerability assessments as Azure VMs, without requiring a separate Log Analytics workspace or MMA agent.

Answer

Microsoft Monitoring Agent (MMA)

Answer

Azure Security Center agent

Answer

Log Analytics agent

Question 7

Your security operations center (SOC) uses Microsoft Sentinel. You need to create a custom analytics rule that detects when a user signs in from a country not in the allowed list and then accesses a high-value SharePoint site within 10 minutes. The rule should generate an incident only if both conditions occur. Which KQL operator should you use in the rule query?

Accepted Answer

join. (join) because the rule requires detecting two sequential events—a sign-in from an unauthorized country and subsequent access to a high-value SharePoint site—that must both occur within a 10-minute window for the same user. The join operator in KQL allows you to correlate two separate data tables (e.g., SigninLogs and SharePointAccessLogs) on a common key (user ID) and enforce a time constraint (e.g., $left.TimeGenerated between $right.TimeGenerated and $right.TimeGenerated + 10m), ensuring that only matching pairs where both conditions are true generate an incident.

Answer

summarize

Answer

union

Answer

where

Question 8

You are configuring Microsoft Defender for Cloud's regulatory compliance dashboard. Your organization must comply with SOC 2. You have enabled the SOC 2 regulatory compliance standard. After a week, some controls show as 'Unhealthy'. What is the most likely reason for the 'Unhealthy' status?

Accepted Answer

The underlying Azure Policy initiatives have resources that are non-compliant.. The 'Unhealthy' status in Defender for Cloud's regulatory compliance dashboard indicates that the underlying Azure Policy initiatives associated with the SOC 2 standard have identified resources that are non-compliant. Defender for Cloud maps regulatory standards to Azure Policy definitions, and the compliance score is derived from the compliance state of those policies. Therefore, when controls show as 'Unhealthy', it is because the corresponding Azure Policy evaluations have found resources that do not meet the required configuration or security controls defined by SOC 2.

Answer

The standard is not fully enabled for all subscriptions.

Answer

The SOC 2 standard is not supported by Defender for Cloud.

Answer

You need to manually attest to the controls to mark them as healthy.

Question 9

Refer to the exhibit. You are creating a Microsoft Sentinel scheduled analytics rule using the KQL query shown. The rule is set to run every hour. What will this rule detect?

Accepted Answer

Accounts that have more than 10 failed logins from a specific IP address in the last hour. The KQL query uses `summarize` with `bin(TimeGenerated, 1h)` to count failed logins per account and IP address within 1-hour bins. The `where` clause filters for `ResultType == 50057` (failed logins) and `where count_ > 10` ensures only accounts with more than 10 failed logins from a specific IP in that hour are returned. Since the rule runs every hour, it detects accounts exceeding 10 failed logins from a single IP in the last hour.

Answer

Successful logins from a single IP address

Answer

Total failed logins in the last 24 hours

Answer

Accounts with more than 10 failed logins from any IP address

Question 10

Your organization uses Microsoft Defender for Cloud to protect Azure SQL databases. You need to enable Advanced Threat Protection (ATP) for Azure SQL. Where should you configure this?

Accepted Answer

In the Azure SQL server blade under Security. Advanced Threat Protection (ATP) for Azure SQL is enabled at the Azure SQL server level, not at the individual database level, because ATP policies and threat detection configurations apply to all databases hosted on that server. In the Azure portal, this is configured under the Azure SQL server blade's 'Security' section, specifically in the 'Microsoft Defender for Cloud' pane, where you can enable 'Microsoft Defender for SQL' (which includes ATP). This ensures that all databases on the server inherit the protection, including vulnerability assessment and threat detection alerts.

Answer

In the Microsoft Defender for Cloud subscription settings

Answer

In the Azure resource group where the SQL server resides

Answer

In the Azure SQL database blade under Security

Question 11

Which TWO are benefits of using Microsoft Sentinel's automation rules? (Choose two.)

Accepted Answer

Trigger a playbook when an incident is created or updated.. Microsoft Sentinel automation rules can trigger a playbook (a collection of automated actions) when an incident is created or updated. This allows security teams to automate response actions, such as sending notifications or blocking IP addresses, directly from incident lifecycle events. Option E is correct because automation rules can automatically assign incidents to a specific analyst or team based on criteria like severity or category, streamlining incident ownership and accountability.

Answer

Aggregate multiple incidents into a single incident.

Answer

Create new analytics rules based on incident patterns.

Answer

Automatically query external threat intelligence feeds.

Question 12

Which THREE are valid Microsoft Defender for Cloud plans? (Choose three.)

Accepted Answer

Defender for SQL. Defender for SQL is a valid Microsoft Defender for Cloud plan that provides advanced SQL security capabilities, including vulnerability assessments, threat detection, and data discovery and classification for Azure SQL Database, Azure SQL Managed Instance, and SQL Server on Azure VMs. It is natively integrated into Defender for Cloud's unified dashboard, enabling centralized security management for SQL assets.

Answer

Defender for Identity

Answer

Defender for Office 365

Question 13

Which TWO are capabilities of Microsoft Sentinel UEBA? (Choose two.)

Accepted Answer

Entity pages with timelines and related events. Microsoft Sentinel UEBA (User and Entity Behavior Analytics) provides entity pages that aggregate timelines and related events for users, hosts, and other entities, enabling security analysts to investigate anomalous behavior in context. This is a core capability of UEBA, as it surfaces behavioral insights directly within the entity's profile.

Answer

Integration with external threat intelligence feeds

Answer

Automatic incident creation for all detected anomalies

Answer

Automated response actions like blocking IPs

Question 14

Refer to the exhibit. You are reviewing the encryption configuration of an Azure Log Analytics workspace used by Microsoft Sentinel. The configuration shows infrastructure encryption enabled and customer-managed key (CMK) from Azure Key Vault. What additional step must be taken to ensure that the CMK is used for all data?

Accepted Answer

Grant the Log Analytics workspace access to the Key Vault key. When you configure a customer-managed key (CMK) for a Log Analytics workspace, you must explicitly grant the workspace (via its managed identity) the 'Get', 'Unwrap Key', and 'Wrap Key' permissions on the Key Vault key. Without this access, the workspace cannot use the CMK to encrypt data at rest. Option C correctly identifies this required step.

Answer

Enable double encryption on Sentinel

Answer

Enable purge protection on the Key Vault

Answer

Ensure the Key Vault is in a different region than the workspace

Question 15

You are a security engineer for a company that uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions are continuously assessed against the Microsoft cloud security benchmark (MCSB). The solution must automatically assign compliance standards to new subscriptions. What should you do?

Accepted Answer

Assign the MCSB standard to the management group that contains all subscriptions.. Assigning the MCSB standard to the management group that contains all subscriptions ensures that the compliance standard is automatically inherited by all existing and future subscriptions under that management group. This meets the requirement for continuous assessment and automatic assignment to new subscriptions without manual intervention.

Answer

Enable the 'Foundational CSPM' plan in Defender for Cloud at the management group scope.

Answer

Assign the MCSB standard to each subscription individually using the Defender for Cloud regulatory compliance dashboard.

Answer

Create an Azure Policy initiative that enforces MCSB and assign it to the root management group.