AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 7 — 15 Questions

Question 1

Your company uses Microsoft Sentinel to monitor security events. You are asked to create an analytics rule that detects when a user outside of business hours (9 PM to 5 AM) performs a high-risk operation like deleting a large number of Azure resources. The rule must trigger an incident and assign it to the SOC team. Which rule type and configuration should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Scheduled query rule with a KQL query filtering sign-in logs and resource deletion events outside business hours.. A scheduled query rule is the correct choice because it allows you to define a custom KQL query that specifically filters sign-in logs and Azure resource deletion events occurring outside business hours (9 PM to 5 AM). This rule type supports complex logic, such as joining multiple data sources (e.g., SigninLogs and AuditLogs), and can trigger an incident with automated assignment to the SOC team via the incident configuration. Scheduled rules are ideal for detecting known patterns with precise time-based conditions.

Answer

Create an Anomaly rule based on historical user behavior.

Answer

Create a Near-real-time (NRT) rule with a query that detects resource deletions.

Answer

Create a Fusion rule that correlates alerts from Microsoft Defender XDR.

Question 2

You are responsible for securing an Azure environment using Microsoft Defender for Cloud. You need to reduce the number of false positive security alerts for a specific Azure SQL Database. The database is regularly scanned by a legitimate security tool that generates alerts. What should you do?

Accepted Answer

Create a suppression rule for the specific alert type and source IP address.. Microsoft Defender for Cloud allows you to create suppression rules to automatically filter out specific security alerts that are known to be benign. By configuring a suppression rule for the specific alert type and the source IP address of the legitimate security scanning tool, you can prevent those alerts from appearing in the security alerts queue without disabling broader detection for SQL databases. This approach reduces false positives while maintaining visibility into other potential threats.

Answer

Disable the security alert rule for SQL databases in Defender for Cloud.

Answer

Exclude the database from the vulnerability assessment solution.

Answer

Modify the Azure SQL Database firewall rules to allow the scanning tool's IP.

Question 3

Your organization is deploying Microsoft Sentinel in a multi-region environment. You need to design a workspace architecture that minimizes data egress costs while ensuring that data from all regions is available for queries and incident investigation. The security team is centralized in the US. What should you do?

Accepted Answer

Deploy a single Sentinel workspace in the US and stream logs from all regions to that workspace.. Deploying a single Sentinel workspace in the US and streaming logs from all regions to that workspace minimizes data egress costs, as data transfer into Azure is free, and egress charges only apply when data leaves the region. This architecture ensures all logs are centrally available for queries and incident investigation by the US-based security team, avoiding cross-region egress fees while maintaining full query capability.

Answer

Deploy Sentinel workspaces in the US and Europe and use Azure Lighthouse to unify querying.

Answer

Deploy a Sentinel workspace in each region and use Azure Data Explorer for centralized analytics.

Answer

Deploy a Sentinel workspace in each region and use cross-workspace queries.

Question 4

A company uses Microsoft Defender for Cloud to assess the security posture of its Azure resources. The security team notices that the secure score is lower than expected because many recommendations are marked as 'Unhealthy' for resources that are not yet deployed (planned resources). How should you ensure that the secure score accurately reflects only deployed resources?

Accepted Answer

Assign Azure Policy to audit only deployed resources and create exemptions for planned resources.. Azure Policy exemptions allow you to exclude specific resources (such as planned, non-deployed resources) from policy evaluation, ensuring that only deployed resources are assessed for compliance. By assigning a policy to audit only deployed resources and creating exemptions for planned resources, the secure score in Microsoft Defender for Cloud reflects only the security posture of actual, in-use resources. This approach avoids disabling recommendations entirely or relying on tags, which would not accurately exclude non-deployed resources from the score.

Answer

Create custom Azure Policy initiatives that exclude non-deployed resources.

Answer

Disable the recommendations for resources that are not yet deployed.

Answer

Ensure that only resources with a specific tag are assessed.

Question 5

You need to enable Microsoft Defender for Cloud's workload protection for Azure Kubernetes Service (AKS) clusters. Which Defender plan should you enable?

Accepted Answer

Enable Defender for Containers.. To enable workload protection for Azure Kubernetes Service (AKS) clusters in Microsoft Defender for Cloud, you must enable the Defender for Containers plan. This plan provides runtime threat detection, vulnerability assessment, and compliance monitoring specifically for containerized environments, including AKS, Azure Container Registry (ACR), and Azure Container Instances (ACI). It covers Kubernetes audit logs, host-level security, and container image scanning, which are essential for securing AKS workloads.

Answer

Enable the foundational Cloud Security Posture Management (CSPM) plan.

Answer

Enable Defender for SQL.

Answer

Enable Defender for Servers.

Question 6

Your organization uses Microsoft Sentinel to detect and respond to threats. You need to create an automation rule that automatically closes low-severity incidents after 24 hours of inactivity. The rule should apply to all analytics rules. What should you configure?

Accepted Answer

Create an automation rule with condition 'Severity equals Low' and action 'Close incident' after 24 hours.. Microsoft Sentinel automation rules allow you to define conditions (e.g., 'Severity equals Low') and actions (e.g., 'Close incident') with a built-in delay of up to 24 hours. This directly meets the requirement to automatically close low-severity incidents after 24 hours of inactivity, applying to all analytics rules without modifying each one individually.

Answer

Create a playbook that runs on a schedule and closes incidents with low severity.

Answer

Use an Azure Logic App to query Sentinel for low-severity incidents older than 24 hours and close them.

Answer

Modify each analytics rule to set the incident expiration to 24 hours.

Question 7

Your company is using Microsoft Defender for Cloud to monitor hybrid workloads that include on-premises servers and Azure VMs. You need to ensure that all servers are covered by the integrated vulnerability assessment solution (Microsoft Defender Vulnerability Management). What is the minimum requirement for on-premises servers?

Accepted Answer

They must be connected to Azure via Azure Arc and have the Azure Monitor Agent installed.. Microsoft Defender for Cloud's integrated vulnerability assessment solution (Microsoft Defender Vulnerability Management) requires on-premises servers to be connected via Azure Arc and have the Azure Monitor Agent (AMA) installed. Azure Arc provides the necessary hybrid connectivity and identity, while AMA collects the vulnerability data and forwards it to the Defender for Cloud backend for assessment. Without both, the vulnerability scanning cannot be enabled or managed centrally.

Answer

They must have a site-to-site VPN connection to Azure and be registered in Azure Arc.

Answer

They must be part of an Active Directory domain and have the Log Analytics agent installed.

Answer

They must be onboarded to Microsoft Defender for Cloud via Azure Arc and have the Microsoft Defender for Endpoint agent installed.

Question 8

You are configuring Microsoft Sentinel data connectors. Which data connector should you use to ingest logs from Microsoft Entra ID (Azure AD) audit logs and sign-in logs?

Accepted Answer

Microsoft Entra ID connector. The Microsoft Entra ID connector (formerly Azure AD connector) is specifically designed to ingest both audit logs and sign-in logs from Microsoft Entra ID into Microsoft Sentinel. This connector uses the Microsoft Graph API to pull the data, enabling security monitoring of identity-related activities such as user sign-ins, directory changes, and risky sign-in events. The other connectors either focus on different data sources or do not capture the full set of Entra ID logs.

Answer

Office 365 connector

Answer

Microsoft Defender XDR connector

Answer

Azure Activity connector

Question 9

Which TWO actions can you perform using Microsoft Defender for Cloud's regulatory compliance dashboard? (Select two.)

Accepted Answer

View the compliance status for built-in standards like SOC 2 or PCI DSS.. The regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of compliance status against built-in standards such as SOC 2, PCI DSS, ISO 27001, and Azure CIS. This dashboard aggregates security assessments and displays pass/fail status for each control, allowing you to track your compliance posture without manual configuration.

Answer

Create custom regulatory compliance recommendations.

Answer

Automatically remediate non-compliant resources.

Answer

Enable or disable Microsoft Defender plans for a subscription.

Question 10

Which THREE are valid methods to ingest data into Microsoft Sentinel? (Select three.)

Accepted Answer

Microsoft Sentinel Data Collector API. The Microsoft Sentinel Data Collector API is a valid ingestion method because it allows custom logs and data sources to be sent directly to Sentinel via a RESTful API endpoint. This is commonly used for non-standard data sources that do not have built-in connectors, enabling organizations to ingest data from custom applications or legacy systems.

Answer

Azure CLI

Answer

Azure Data Factory

Question 11

Which TWO are features of Microsoft Defender for Cloud's workload protection for Azure SQL databases? (Select two.)

Accepted Answer

Advanced threat protection (ATP). Advanced Threat Protection (ATP) for Azure SQL databases detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. It provides a security layer that alerts on suspicious events like SQL injection, brute-force attacks, or unusual access patterns, enabling rapid response to threats.

Answer

File integrity monitoring (FIM)

Answer

Adaptive network hardening

Answer

Just-in-time VM access

Question 12

Refer to the exhibit. You are reviewing a scheduled analytics rule in Microsoft Sentinel that uses the KQL query shown. The rule is configured to run every hour. A security analyst reports that the rule is generating too many incidents. What is the most likely cause?

Accepted Answer

The query does not filter out known safe IP addresses sufficiently.. The query likely uses a broad filter for sign-in events without excluding known safe IP addresses (e.g., corporate VPNs, trusted services). This causes every sign-in from those IPs to generate an incident, overwhelming the rule with false positives. The rule's frequency (every hour) is not the issue; the query logic is insufficiently scoped.

Answer

The rule is configured to run too frequently.

Answer

The query uses 'ago(1h)' which includes data from the previous hour, causing duplicate incidents.

Answer

The query has a syntax error that causes all sign-ins to match.

Question 13

Refer to the exhibit. You are reviewing a custom Azure Policy definition used in Microsoft Defender for Cloud. The policy is intended to deploy a vulnerability assessment solution on SQL Managed Instances that do not have one. However, the policy is not being evaluated for any resources. What is the most likely reason?

Accepted Answer

The role definition ID specified in the deployment details does not have the necessary permissions to deploy the vulnerability assessment.. The policy uses a 'deployIfNotExists' effect, which requires a managed identity with specific RBAC permissions to deploy the vulnerability assessment solution. If the role definition ID specified in the policy's deployment details lacks the necessary permissions (e.g., 'SQL Security Manager' or 'Contributor' on the SQL Managed Instance), the policy will fail to evaluate or deploy, resulting in no resources being assessed.

Answer

The policy type is set to 'Custom' instead of 'BuiltIn'.

Answer

The resource type in the policy condition is incorrect.

Answer

The policy condition checks for the existence of vulnerability assessment, but it should check for non-existence.

Question 14

Refer to the exhibit. You are assigning a built-in Azure Policy definition to a subscription using Azure CLI. The policy is 'Audit VMs that do not use managed disks'. After assignment, you check in Microsoft Defender for Cloud and see that the policy is not generating any recommendations. What is the most likely reason?

Accepted Answer

The policy is not part of a Defender for Cloud security initiative.. Microsoft Defender for Cloud only generates security recommendations from policies that are part of a built-in or custom security initiative (such as the 'Microsoft cloud security benchmark' initiative). A standalone policy assignment, even if it has the 'Audit' effect, will not appear as a recommendation in Defender for Cloud unless it is included in an initiative that Defender for Cloud monitors.

Answer

The policy effect is set to 'Audit', but it should be 'Deny' to generate recommendations.

Answer

The policy requires a managed identity to run.

Answer

The policy is assigned to the wrong subscription.

Question 15

A company uses Microsoft Defender for Cloud to secure its hybrid environment. The security team notices that many alerts are low severity and causing alert fatigue. They want to reduce noise without missing critical threats. What should they configure?

Accepted Answer

Configure security policies with severity-based suppression rules. Microsoft Defender for Cloud allows you to configure security policies with severity-based suppression rules to automatically dismiss low-severity alerts that meet specific criteria, such as alert name, resource, or severity level. This reduces alert fatigue while ensuring critical threats are still surfaced, as suppression rules can be scoped and managed without disabling the underlying detection logic.

Answer

Manually dismiss each low-severity alert

Answer

Disable low-severity alerts in Microsoft Defender for Cloud

Answer

Enable Microsoft Entra Permissions Management