AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 7 — 15 Questions

Question 1

Your security operations center (SOC) uses Microsoft Sentinel. You need to create a custom analytics rule that detects when a user signs in from a country not in the allowed list and then accesses a high-value SharePoint site within 10 minutes. The rule should generate an incident only if both conditions occur. Which KQL operator should you use in the rule query?

Accepted Answer

join. Option C is correct because 'join' allows combining two event streams on a common key (e.g., user ID) and time window. Option A is wrong because 'union' combines rows, not conditionally. Option B is wrong because 'summarize' aggregates. Option D is wrong because 'where' filters a single table.

Answer

summarize

Answer

union

Answer

where

Question 2

You are configuring Microsoft Defender for Cloud's regulatory compliance dashboard. Your organization must comply with SOC 2. You have enabled the SOC 2 regulatory compliance standard. After a week, some controls show as 'Unhealthy'. What is the most likely reason for the 'Unhealthy' status?

Accepted Answer

The underlying Azure Policy initiatives have resources that are non-compliant.. Option B is correct because 'Unhealthy' in regulatory compliance means that the corresponding Azure Policy assessments have failed. Option A is wrong because if no resources were assessed, it would be 'Not registered'. Option C is wrong because the standard is enabled. Option D is wrong because the dashboard does not require manual attestation for SOC 2.

Answer

The standard is not fully enabled for all subscriptions.

Answer

The SOC 2 standard is not supported by Defender for Cloud.

Answer

You need to manually attest to the controls to mark them as healthy.

Question 3

Refer to the exhibit. You are creating a Microsoft Sentinel scheduled analytics rule using the KQL query shown. The rule is set to run every hour. What will this rule detect?

Accepted Answer

Accounts that have more than 10 failed logins from a specific IP address in the last hour. Option D is correct because the query counts failed logins (EventID 4625) per account and IP address in the last hour, then filters for more than 10. Option A is wrong because it's about failed logins, not successful. Option B is wrong because it's per account and IP, not just per account. Option C is wrong because it's per hour, not cumulative across days.

Answer

Successful logins from a single IP address

Answer

Total failed logins in the last 24 hours

Answer

Accounts with more than 10 failed logins from any IP address

Question 4

Your organization uses Microsoft Defender for Cloud to protect Azure SQL databases. You need to enable Advanced Threat Protection (ATP) for Azure SQL. Where should you configure this?

Accepted Answer

In the Azure SQL server blade under Security. Option C is correct because ATP for Azure SQL is enabled at the server level, not the database level. Option A is wrong because it's at server level. Option B is wrong because it's not a subscription-level setting. Option D is wrong because it's not a resource group setting.

Answer

In the Microsoft Defender for Cloud subscription settings

Answer

In the Azure resource group where the SQL server resides

Answer

In the Azure SQL database blade under Security

Question 5

Which TWO are benefits of using Microsoft Sentinel's automation rules? (Choose two.)

Accepted Answer

Trigger a playbook when an incident is created or updated.. Option A and D are correct. Automation rules can automatically assign incidents to analysts (A) and trigger playbooks based on conditions (D). Option B is wrong because automation rules do not create analytics rules. Option C is wrong because automation rules do not aggregate incidents; they can suppress or create tasks. Option E is wrong because automation rules do not query external threat intelligence feeds.

Answer

Aggregate multiple incidents into a single incident.

Answer

Create new analytics rules based on incident patterns.

Answer

Automatically query external threat intelligence feeds.

Question 6

Which THREE are valid Microsoft Defender for Cloud plans? (Choose three.)

Accepted Answer

Defender for SQL. Options A, C, and E are correct. Defender for Cloud plans include Defender for Servers (A), Defender for SQL (C), and Defender for Storage (E). Option B is wrong because Defender for Office is part of Microsoft 365 Defender, not Defender for Cloud. Option D is wrong because Defender for Identity is a separate Microsoft 365 Defender product.

Answer

Defender for Identity

Answer

Defender for Office 365

Question 7

Which TWO are capabilities of Microsoft Sentinel UEBA? (Choose two.)

Accepted Answer

Entity pages with timelines and related events. Options A and D are correct. UEBA can detect anomalous behavior based on peer group analysis (A) and provide entity pages with investigative insights (D). Option B is wrong because threat intelligence feeds are separate. Option C is wrong because UEBA does not automatically create incidents; analytics rules do. Option E is wrong because automated response is via playbooks, not UEBA.

Answer

Integration with external threat intelligence feeds

Answer

Automatic incident creation for all detected anomalies

Answer

Automated response actions like blocking IPs

Question 8

Which THREE are prerequisites for integrating Microsoft Sentinel with Microsoft Defender XDR? (Choose three.)

Accepted Answer

Appropriate permissions (Security Administrator or Global Administrator). Options B, C, and D are correct. You need appropriate permissions (B), a valid license for Microsoft 365 Defender (C), and the data connector must be enabled in Sentinel (D). Option A is wrong because you don't need an Azure Sentinel workspace in a specific region; any region works. Option E is wrong because you don't need to install agents on endpoints; Defender XDR collects data automatically.

Answer

The Microsoft Monitoring Agent installed on all endpoints

Answer

An Azure Sentinel workspace in the same region as the Microsoft 365 tenant

Question 9

Refer to the exhibit. You are reviewing the encryption configuration of an Azure Log Analytics workspace used by Microsoft Sentinel. The configuration shows infrastructure encryption enabled and customer-managed key (CMK) from Azure Key Vault. What additional step must be taken to ensure that the CMK is used for all data?

Accepted Answer

Grant the Log Analytics workspace access to the Key Vault key. Option C is correct because when using CMK with Log Analytics, you must grant the Log Analytics service principal (or managed identity) access to the Key Vault key. Option A is wrong because Sentinel itself does not directly use the key. Option B is wrong because the key must be in the same region as the workspace. Option D is wrong because soft-delete must be enabled, not purge protection specifically.

Answer

Enable double encryption on Sentinel

Answer

Enable purge protection on the Key Vault

Answer

Ensure the Key Vault is in a different region than the workspace

Question 10

You are a security engineer for a company that uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions are continuously assessed against the Microsoft cloud security benchmark (MCSB). The solution must automatically assign compliance standards to new subscriptions. What should you do?

Accepted Answer

Assign the MCSB standard to the management group that contains all subscriptions.. Option D is correct because Microsoft Defender for Cloud allows you to assign regulatory compliance standards, including MCSB, at the management group level, which automatically applies to all subscriptions under that group. Option A is wrong because Azure Policy can enforce standards, but the question specifically asks about MCSB in Defender for Cloud. Option B is wrong because assigning at the subscription level does not cover new subscriptions automatically. Option C is wrong because Defender for Cloud plans enable features but do not assign compliance standards.

Answer

Enable the 'Foundational CSPM' plan in Defender for Cloud at the management group scope.

Answer

Assign the MCSB standard to each subscription individually using the Defender for Cloud regulatory compliance dashboard.

Answer

Create an Azure Policy initiative that enforces MCSB and assign it to the root management group.

Question 11

Your company uses Microsoft Sentinel to monitor security events. You are asked to create an analytics rule that detects when a user outside of business hours (9 PM to 5 AM) performs a high-risk operation like deleting a large number of Azure resources. The rule must trigger an incident and assign it to the SOC team. Which rule type and configuration should you use?

Accepted Answer

Create a Scheduled query rule with a KQL query filtering sign-in logs and resource deletion events outside business hours.. Option A is correct because scheduled query rules can run at defined intervals and use KQL to filter events based on time and activity. Option B is wrong because NRT rules are for near-real-time detection but are limited to simple conditions. Option C is wrong because anomaly rules use machine learning for baseline deviations, not specific time-based conditions. Option D is wrong because fusion rules correlate alerts from multiple sources, not specific user activities.

Answer

Create an Anomaly rule based on historical user behavior.

Answer

Create a Near-real-time (NRT) rule with a query that detects resource deletions.

Answer

Create a Fusion rule that correlates alerts from Microsoft Defender XDR.

Question 12

You are responsible for securing an Azure environment using Microsoft Defender for Cloud. You need to reduce the number of false positive security alerts for a specific Azure SQL Database. The database is regularly scanned by a legitimate security tool that generates alerts. What should you do?

Accepted Answer

Create a suppression rule for the specific alert type and source IP address.. Option C is correct because creating a suppression rule in Defender for Cloud allows you to suppress alerts based on specific criteria like IP address or alert title, reducing false positives. Option A is wrong because disabling the alert rule would miss real threats. Option B is wrong because excluding the database from vulnerability assessment would also miss real vulnerabilities. Option D is wrong because modifying the firewall rules is not related to alert suppression.

Answer

Disable the security alert rule for SQL databases in Defender for Cloud.

Answer

Exclude the database from the vulnerability assessment solution.

Answer

Modify the Azure SQL Database firewall rules to allow the scanning tool's IP.

Question 13

Your organization is deploying Microsoft Sentinel in a multi-region environment. You need to design a workspace architecture that minimizes data egress costs while ensuring that data from all regions is available for queries and incident investigation. The security team is centralized in the US. What should you do?

Accepted Answer

Deploy a single Sentinel workspace in the US and stream logs from all regions to that workspace.. Option B is correct because using a single workspace in the US centralizes data and minimizes costs, as data from other regions can be collected via diagnostic settings without egress fees for Azure-to-Azure traffic within the same continent. Option A is wrong because multiple workspaces increase egress costs and complexity. Option C is wrong because it does not reduce egress costs. Option D is wrong because using multiple workspaces with cross-workspace queries increases egress costs.

Answer

Deploy Sentinel workspaces in the US and Europe and use Azure Lighthouse to unify querying.

Answer

Deploy a Sentinel workspace in each region and use Azure Data Explorer for centralized analytics.

Answer

Deploy a Sentinel workspace in each region and use cross-workspace queries.

Question 14

A company uses Microsoft Defender for Cloud to assess the security posture of its Azure resources. The security team notices that the secure score is lower than expected because many recommendations are marked as 'Unhealthy' for resources that are not yet deployed (planned resources). How should you ensure that the secure score accurately reflects only deployed resources?

Accepted Answer

Assign Azure Policy to audit only deployed resources and create exemptions for planned resources.. Option D is correct because assigning Azure Policy at the management group scope with a 'DeployIfNotExists' or 'AuditIfNotExists' effect can enforce governance on deployed resources only, and using exemptions for non-deployed resources. Option A is wrong because disabling recommendations affects all resources. Option B is wrong because the secure score automatically considers only assessed resources, but the issue might be with planned resources being assessed incorrectly. Option C is wrong because creating custom initiatives does not filter out non-deployed resources automatically.

Answer

Create custom Azure Policy initiatives that exclude non-deployed resources.

Answer

Disable the recommendations for resources that are not yet deployed.

Answer

Ensure that only resources with a specific tag are assessed.

Question 15

You need to enable Microsoft Defender for Cloud's workload protection for Azure Kubernetes Service (AKS) clusters. Which Defender plan should you enable?

Accepted Answer

Enable Defender for Containers.. Option A is correct because the 'Defender for Containers' plan provides threat protection for AKS, including runtime threat detection. Option B is wrong because Defender for Cloud's foundational CSPM is free and does not provide advanced workload protection. Option C is wrong because Defender for Servers applies to VMs, not AKS. Option D is wrong because Defender for SQL applies to databases.

Answer

Enable the foundational Cloud Security Posture Management (CSPM) plan.

Answer

Enable Defender for SQL.

Answer

Enable Defender for Servers.