AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud with the CSPM plan enabled. You need to ensure that all Azure subscriptions have Microsoft Defender for Cloud's auto-provisioning enabled for the Log Analytics agent. Which Azure Policy initiative should you assign?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy Log Analytics agent for Microsoft Defender for Cloud. The 'Deploy Log Analytics agent for Microsoft Defender for Cloud' policy initiative is specifically designed to enable auto-provisioning of the Log Analytics agent across all Azure subscriptions. This initiative ensures that the agent is automatically installed on supported Azure VMs, allowing Defender for Cloud to collect security-related data and apply the CSPM plan's assessments. Assigning this initiative at the subscription or management group level enforces the auto-provisioning configuration required by the question.

Answer

Configure backup on virtual machines

Answer

CIS Microsoft Azure Foundations Benchmark

Answer

Azure Security Benchmark

Question 2

Which THREE Microsoft Defender for Cloud features require Microsoft Defender for Servers Plan 2? (Choose three.)

Accepted Answer

File Integrity Monitoring (FIM). File Integrity Monitoring (FIM) (A) is correct because it monitors critical OS files, registry keys, and application files for changes and is only available with Defender for Servers Plan 2, not the free or Plan 1 tiers. Adaptive application controls (C) are correct because they use machine learning to create allowlists of known-safe applications and require Plan 2 to enable the control and enforcement capabilities. Adaptive network hardening (D) is correct because it analyzes network traffic and NSG rules to recommend tightening them, a feature exclusive to Defender for Servers Plan 2. Just-In-Time VM access (B) is not exclusive to Plan 2 because it is available in Defender for Servers Plan 1 as well. Integrated vulnerability assessment (E) is not exclusive to Plan 2 because it is included in Defender for Servers Plan 1 (and also offered as a standalone/agentless option), so it does not require Plan 2.

Answer

Just-In-Time VM access

Answer

Integrated vulnerability assessment (Qualys)

Question 3

Which TWO data sources can be connected to Microsoft Sentinel using built-in data connectors? (Choose two.)

Accepted Answer

Microsoft 365 Defender incidents. Option B is correct because Microsoft Sentinel ships with a built-in connector for Microsoft 365 Defender that ingests incidents and alerts (and advanced hunting events) directly from the Defender portal with no custom development. Option C is correct because the Microsoft Entra ID (Microsoft Entra ID) connector is a native, first-party Sentinel connector that streams sign-in logs, audit logs, and provisioning events via diagnostic settings. Option A is not a built-in connector in the sense tested here; AWS CloudTrail requires configuring the AWS S3/CloudTrail connector through the AWS role setup, which is a solution/partner-based integration rather than a simple built-in one. Option D is wrong because MySQL audit logs have no native Sentinel connector and would require a custom log ingestion method such as the Logs Ingestion API or an agent-based parser. Option E is wrong because on-premises Windows Firewall logs are not a built-in connector; they must be collected via the Log Analytics agent/AMA and a custom data collection rule or parser.

Answer

Amazon Web Services (AWS) CloudTrail

Answer

MySQL audit logs

Answer

On-premises Windows Firewall logs

Question 4

What is the primary purpose of this KQL query?

Accepted Answer

Identify the most common alert types by severity over the last week. The query is designed to summarize alert data over the last 7 days and group it by alert type and severity, which directly supports identifying the most common alert types by severity over the last week, so option D is correct. This is the typical purpose of a KQL aggregation using a time filter such as `where TimeGenerated > ago(7d)` combined with `summarize count() by AlertName, Severity` or similar. Option A is incorrect because the query does not filter for resolved or auto-resolved alerts. Option B is incorrect because false positive rates require additional data such as alert status or triage outcomes, which are not part of a simple alert-type/severity summary. Option C is incorrect because correlating with Microsoft Defender for Cloud incidents would require joining or referencing incident tables, not just summarizing alerts.

Answer

Check for alerts that have been automatically resolved

Answer

Identify alerts with high false positive rates over the last 7 days

Answer

Correlate alerts with Microsoft Defender for Cloud incidents

Question 5

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. The security team wants to implement a continuous compliance monitoring solution using Microsoft Defender for Cloud's regulatory compliance dashboard. They need to monitor compliance against the 'CIS Microsoft Azure Foundations Benchmark' and 'PCI DSS v3.2.1'. Currently, the subscription has the 'Azure Security Benchmark' initiative assigned. You need to configure the compliance dashboard to show both CIS and PCI DSS standards. The subscription already has Microsoft Defender for Cloud's CSPM plan enabled. You have also enabled the 'Defender for Cloud' plan for servers. What should you do to meet the requirements?

Accepted Answer

Add the CIS Microsoft Azure Foundations Benchmark and PCI DSS v3.2.1 policy initiatives to the regulatory compliance dashboard.. To display CIS and PCI DSS standards in the regulatory compliance dashboard, you add the corresponding policy initiatives to the dashboard. Microsoft Defender for Cloud's regulatory compliance dashboard can show multiple standards simultaneously, and adding the CIS Microsoft Azure Foundations Benchmark and PCI DSS v3.2.1 initiatives makes them appear alongside the existing Azure Security Benchmark.

Answer

Enable the CIS benchmark in the Microsoft Defender for Cloud settings.

Answer

Enable Microsoft Defender for Cloud's regulatory compliance add-on.

Answer

Remove the Azure Security Benchmark initiative and assign the CIS and PCI DSS initiatives.

Question 6

You are a security analyst at Fabrikam Inc. You have deployed Microsoft Sentinel and connected it to Microsoft 365 Defender (formerly Microsoft Threat Protection). You have also enabled UEBA and set up analytics rules for detecting suspicious sign-ins. Recently, you noticed that some high-severity incidents from Microsoft 365 Defender are not appearing in Microsoft Sentinel. You have verified that the Microsoft 365 Defender connector is enabled and that incidents are being sent to the workspace. However, the incidents are not being created as Sentinel incidents. What is the most likely reason?

Accepted Answer

The 'Microsoft 365 Defender' incident creation rule in Microsoft Sentinel is disabled.. The correct answer is B: the 'Microsoft 365 Defender' incident creation rule in Microsoft Sentinel is disabled. When you connect Microsoft 365 Defender to Sentinel, incidents are ingested via the connector, but Sentinel only creates its own incidents from those if the corresponding incident creation rule (under Configuration > Analytics > Microsoft 365 Defender) is enabled; if it is turned off, the Defender incidents arrive in the workspace but no Sentinel incidents are generated, which matches the symptom of high-severity incidents not appearing. Option A is wrong because analytics rules for sign-ins operate on sign-in logs and do not block or conflict with the Defender connector's incident ingestion. Option C is wrong because the Microsoft 365 Defender connector does not require a separate premium license to create incidents in Sentinel. Option D is wrong because Sentinel can create incidents from Microsoft 365 Defender incidents when the incident creation rule is enabled, so it is not a platform limitation.

Answer

The analytics rule for sign-in detection is conflicting with the Microsoft 365 Defender connector.

Answer

The Microsoft 365 Defender connector requires a premium license.

Answer

Microsoft Sentinel cannot create incidents from Microsoft 365 Defender incidents; only alerts can be ingested.

Question 7

You have a Microsoft Sentinel workspace that ingests data from multiple sources, including Azure Activity, Microsoft Entra ID, and Azure Firewall. You need to create a custom analytics rule that detects when a user signs in from an IP address that has been flagged as malicious in a threat intelligence feed. You have already imported threat intelligence indicators into Sentinel using the 'Threat Intelligence - TAXII' data connector. The threat intelligence indicators are stored in the 'ThreatIntelligenceIndicator' table. Which KQL function should you use in the analytics rule to match sign-in logs against the threat indicators?

Accepted Answer

threat_intelligence_check_ip. The correct option is D, threat_intelligence_check_ip, because this KQL function is specifically designed to match IP address values in your logs against IP indicators stored in the ThreatIntelligenceIndicator table, which is exactly the scenario of detecting sign-ins from flagged malicious IPs. It joins the SigninLogs IPAddress column with the threat intelligence indicators and returns matches, making it the appropriate function for an analytics rule. Option A, threat_intelligence_check_url, is for matching URLs, and option B, threat_intelligence_check_hash, is for matching file hashes, neither of which applies to IP-based sign-in detection. Option C, ipv4_lookup, is a general IP enrichment function that matches against a lookup table but is not the dedicated threat intelligence matching function used with the ThreatIntelligenceIndicator table.

Answer

threat_intelligence_check_url

Answer

threat_intelligence_check_hash

Answer

ipv4_lookup

Question 8

Your organization uses Microsoft Sentinel for security operations. You need to create a custom analytics rule that triggers an incident when a user executes a suspicious PowerShell command on a Windows server. The logs are stored in the 'DeviceEvents' table from Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). The rule should run every 5 minutes. Which scheduling frequency and query period should you configure?

Accepted Answer

Run query every 5 minutes with a query period of 5 minutes. The correct option is C: run the query every 5 minutes with a query period of 5 minutes. In Microsoft Sentinel, the rule's scheduling frequency defines how often the analytics rule runs, and the query period defines the lookback window of data the query evaluates; setting both to 5 minutes matches the stated requirement to run every 5 minutes while covering the most recent 5 minutes of DeviceEvents data for suspicious PowerShell execution. Option A uses a 10-minute frequency, which violates the every-5-minutes requirement, and its 5-minute lookback would also leave gaps between runs. Option B runs at the right frequency but a 1-minute query period is shorter than the 5-minute interval, so events could be missed between executions. Option D runs at the right frequency but a 10-minute query period overlaps the previous run and re-evaluates older events, which is unnecessary and can cause duplicate alerts.

Answer

Run query every 10 minutes with a query period of 5 minutes

Answer

Run query every 5 minutes with a query period of 1 minute

Answer

Run query every 5 minutes with a query period of 10 minutes

Question 9

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to create a custom analytics rule that detects when a user account is created in Microsoft Entra ID and then, within 24 hours, that account is granted a privileged role (e.g., Global Administrator). You have set up the necessary data connectors to ingest Microsoft Entra ID audit logs and sign-in logs into Sentinel. The rule should trigger an incident with high severity when this sequence occurs. Which KQL query should you use in the analytics rule?

Accepted Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated <= 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated > 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=leftouter (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].id == $right.TargetResources[0].id | where TimeGenerated > 24h

Answer

AuditLogs | where OperationName == "Add user" | join kind=inner (AuditLogs | where OperationName contains "Add member to role") on $left.TargetResources[0].displayName == $right.TargetResources[0].displayName | where TimeGenerated <= 24h

Question 10

Your company has deployed Microsoft Defender for Cloud in all subscriptions. You need to ensure that all Azure SQL databases are protected by Advanced Threat Protection (ATP). You want to enable ATP at the subscription level so that new databases are automatically protected. The security policy must be enforced to prevent administrators from disabling ATP on individual databases. What should you do?

Accepted Answer

Create a custom Azure Policy with a 'Deny' effect that prevents setting the Advanced Threat Protection setting to 'Disabled' on SQL databases.. It uses a custom Azure Policy with a 'Deny' effect to enforce that Advanced Threat Protection (ATP) cannot be disabled on any SQL database, including new ones. This approach ensures that the security policy is enforced at the subscription level, preventing administrators from turning off ATP on individual databases, which aligns with the requirement for automatic protection and enforcement.

Answer

Create an Azure Policy assignment using the built-in policy 'Advanced Threat Protection should be enabled on your SQL servers' with a 'Deny' effect.

Answer

Enable the 'Azure SQL databases' plan in Defender for Cloud at the subscription level.

Answer

Create an Azure Policy assignment that audits if Advanced Threat Protection is enabled on SQL databases, and remediate non-compliant resources.

Question 11

You are configuring Microsoft Defender for Cloud to protect an Azure Kubernetes Service (AKS) cluster. The cluster runs sensitive workloads. You need to enable threat detection and vulnerability assessment for the AKS environment. Which THREE of the following should you enable?

Accepted Answer

Microsoft Defender for Containers plan. Option A (Microsoft Defender for Containers plan) is correct because it is the specific Defender for Cloud plan that provides threat detection for AKS clusters, including control-plane audit log analysis, runtime workload protection, and Kubernetes-native alerting. Option C (Vulnerability assessment for container images in Defender for Cloud) is correct because it scans images in Azure Container Registry and running containers for known CVEs, which is required for vulnerability assessment of the AKS environment. Option D (Continuous export of security alerts to Log Analytics) is correct because continuous export streams Defender for Cloud alerts and recommendations to a Log Analytics workspace, enabling centralized retention, correlation, and investigation of AKS threat detections. Option B (Microsoft Defender for Servers plan) is not required here because it protects VMs and servers, not the AKS control plane or container workloads specifically. Option E (Azure Policy add-on for AKS) is not a Defender for Cloud threat detection or vulnerability assessment feature; it enforces governance and policy compliance on the cluster.

Answer

Microsoft Defender for Servers plan

Answer

Azure Policy add-on for AKS

Question 12

A security operations team uses Microsoft Sentinel to monitor sign-in logs. They receive frequent false positive alerts for 'Anonymous IP address sign-in' from a specific external IP range used by a trusted partner. The analysts want to suppress these alerts without reducing detection coverage. What is the most efficient approach?

Accepted Answer

Create an alert suppression rule for the specific IP range in the analytics rule. Creating an alert suppression rule in Microsoft Sentinel allows analysts to suppress alerts from specific IP ranges without modifying the underlying analytics rule. Option A is wrong because disabling the analytics rule removes detection entirely. Option B is wrong because watchlists are used for correlation, not suppression. Option D is wrong because automation rules can run actions but not suppress alerts directly; suppression is a built-in feature of analytics rules.

Answer

Add the trusted IP range to a watchlist and reference it in the analytics rule query

Answer

Use an automation rule to close the incidents automatically

Answer

Disable the analytics rule that generates the alert

Question 13

Your organization has enabled Microsoft Defender for Cloud on all subscriptions. You need to ensure that the security score is improved by implementing recommendations. Which TWO actions would directly improve the secure score?

Accepted Answer

Remediate a high-severity recommendation for a SQL database. Option C is correct because Microsoft Defender for Cloud's secure score is calculated from the percentage of passed security assessments (recommendations) versus applicable ones; remediating a high-severity recommendation for a SQL database directly flips that assessment to 'Healthy,' raising the score. Option E is correct because enabling automatic provisioning of the Log Analytics agent (now the Azure Monitor Agent in newer environments) installs the monitoring extension on VMs and servers, which satisfies data-collection-dependent recommendations such as 'Install endpoint protection' and 'Enable adaptive application controls,' directly increasing the secure score. Option A is not marked correct because Just-In-Time VM access is a Defender for Servers feature that reduces attack surface but is not itself a secure score assessment that directly raises the score. Option B is not marked correct because configuring email notifications for high-severity alerts is an alerting/notification setting, not a security posture recommendation, so it does not change the score. Option D is not marked correct because assigning a custom Azure Policy initiative governs compliance and enforcement but does not by itself remediate the built-in assessments that feed the secure score.

Answer

Enable Just-In-Time VM access on all virtual machines

Answer

Configure email notifications for high-severity alerts

Answer

Assign a custom Azure Policy initiative

Question 14

A SOC team uses Microsoft Sentinel. They want to create an analytics rule that detects excessive failed logons from a single IP address. The rule must run every 5 minutes and look back 1 hour. Which THREE components are required to configure this scheduled query rule?

Accepted Answer

Kusto Query Language (KQL) query. Option B is correct because a scheduled analytics rule in Microsoft Sentinel is fundamentally defined by a Kusto Query Language (KQL) query against the Log Analytics workspace (e.g., using the SecurityEvent or SigninLogs table to count failed logons per IP). Option C is correct because the rule's trigger logic requires an alert threshold — the number of query results that must be returned before an alert is generated (e.g., greater than 10 failed logon events from one IP). Option D is correct because incident configuration, including incident creation and entity/alert grouping settings, is a required part of the analytics rule wizard so that alerts are consolidated into actionable incidents. Option A is incorrect because a Fusion rule is a separate built-in rule type that uses machine-learning correlation across signals, not a component of a custom scheduled query rule. Option E is incorrect because a playbook is an optional automated response (Logic App) that can be attached to a rule for remediation, but it is not required to configure the detection itself.

Answer

Fusion rule

Answer

Playbook

Question 15

Refer to the exhibit. You are assigned a policy that deploys the Log Analytics agent to Linux VMs. After assigning this policy to a subscription, you notice that existing Linux VMs are not getting the agent deployed, but newly created VMs receive the agent. What is the most likely reason?

Accepted Answer

The policy assignment requires a remediation task to be created for existing non-compliant VMs. The policy uses 'deployIfNotExists' effect, which requires remediation tasks to be triggered on existing resources; the policy assignment does not automatically remediate existing VMs. Option B is wrong because the policy evaluates all VMs regardless of region. Option C is wrong because the policy does not require a managed identity for deployment; the 'deployIfNotExists' effect uses the system-assigned identity. Option D is wrong because the workspace ID is a required parameter, and if not provided, the assignment would fail.

Answer

The policy only applies to VMs in specific regions

Answer

The workspace ID parameter was not specified during assignment

Answer

The policy requires a managed identity to deploy the extension