AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 8 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel to detect and respond to threats. You need to create an automation rule that automatically closes low-severity incidents after 24 hours of inactivity. The rule should apply to all analytics rules. What should you configure?

Accepted Answer

Create an automation rule with condition 'Severity equals Low' and action 'Close incident' after 24 hours.. Option B is correct because automation rules can trigger on incident creation or update, and you can set conditions (e.g., severity equals Low) and actions (e.g., close incident). The rule should be applied to all analytics rules by not specifying a specific rule. Option A is wrong because playbooks are used for complex automation, but the simple close action can be done directly in automation rules. Option C is wrong because the 'expiration' setting is for scheduled rules, not for closing incidents. Option D is wrong because Azure Logic Apps is not directly integrated into Sentinel automation rules without a playbook.

Answer

Create a playbook that runs on a schedule and closes incidents with low severity.

Answer

Use an Azure Logic App to query Sentinel for low-severity incidents older than 24 hours and close them.

Answer

Modify each analytics rule to set the incident expiration to 24 hours.

Question 2

Your company is using Microsoft Defender for Cloud to monitor hybrid workloads that include on-premises servers and Azure VMs. You need to ensure that all servers are covered by the integrated vulnerability assessment solution (Microsoft Defender Vulnerability Management). What is the minimum requirement for on-premises servers?

Accepted Answer

They must be connected to Azure via Azure Arc and have the Azure Monitor Agent installed.. Option D is correct because the integrated vulnerability assessment (Microsoft Defender Vulnerability Management) for on-premises servers requires that they are onboarded to Microsoft Defender for Cloud with Azure Arc and have the Azure Monitor Agent installed. Option A is wrong because Log Analytics agent is deprecated for Defender for Cloud. Option B is wrong because Defender for Cloud does not require a VPN. Option C is wrong because Azure Arc is required for hybrid servers.

Answer

They must have a site-to-site VPN connection to Azure and be registered in Azure Arc.

Answer

They must be part of an Active Directory domain and have the Log Analytics agent installed.

Answer

They must be onboarded to Microsoft Defender for Cloud via Azure Arc and have the Microsoft Defender for Endpoint agent installed.

Question 3

You are configuring Microsoft Sentinel data connectors. Which data connector should you use to ingest logs from Microsoft Entra ID (Azure AD) audit logs and sign-in logs?

Accepted Answer

Microsoft Entra ID connector. Option C is correct because the Microsoft Entra ID connector in Sentinel specifically ingests audit logs and sign-in logs. Option A is wrong because the Azure Activity connector ingests Azure resource logs, not Entra ID logs. Option B is wrong because the Office 365 connector ingests Exchange and SharePoint logs. Option D is wrong because the Microsoft Defender XDR connector ingests security alerts from Defender products.

Answer

Office 365 connector

Answer

Microsoft Defender XDR connector

Answer

Azure Activity connector

Question 4

Which TWO actions can you perform using Microsoft Defender for Cloud's regulatory compliance dashboard? (Select two.)

Accepted Answer

View the compliance status for built-in standards like SOC 2 or PCI DSS.. Options B and D are correct. The regulatory compliance dashboard allows you to assign compliance standards to subscriptions and view compliance status for built-in standards like SOC 2. Option A is wrong because automating remediation is done via Azure Policy, not the dashboard. Option C is wrong because enabling Defender plans is done in the Environment settings. Option E is wrong because custom recommendations are created via Azure Policy or custom initiatives.

Answer

Create custom regulatory compliance recommendations.

Answer

Automatically remediate non-compliant resources.

Answer

Enable or disable Microsoft Defender plans for a subscription.

Question 5

Which THREE are valid methods to ingest data into Microsoft Sentinel? (Select three.)

Accepted Answer

Microsoft Sentinel Data Collector API. Options B, C, and E are correct. Common Event Format (CEF) is a standard for log ingestion via syslog. Azure Monitor Agent can be used to collect logs from Windows and Linux machines. The Microsoft Sentinel Data Collector API allows custom logs to be ingested. Option A is wrong because Azure CLI is a command-line tool, not a data ingestion method. Option D is wrong because Azure Data Factory is an ETL service, not a direct ingestion method for Sentinel (though it can be used indirectly).

Answer

Azure CLI

Answer

Azure Data Factory

Question 6

Which TWO are features of Microsoft Defender for Cloud's workload protection for Azure SQL databases? (Select two.)

Accepted Answer

Advanced threat protection (ATP). Options A and D are correct. Defender for SQL includes vulnerability assessment and advanced threat protection (ATP) for detecting anomalies. Option B is wrong because adaptive network hardening is for VMs, not SQL. Option C is wrong because just-in-time VM access is for VMs. Option E is wrong because file integrity monitoring is for VMs and servers.

Answer

File integrity monitoring (FIM)

Answer

Adaptive network hardening

Answer

Just-in-time VM access

Question 7

Refer to the exhibit. You are reviewing a scheduled analytics rule in Microsoft Sentinel that uses the KQL query shown. The rule is configured to run every hour. A security analyst reports that the rule is generating too many incidents. What is the most likely cause?

Accepted Answer

The query does not filter out known safe IP addresses sufficiently.. Option B is correct because the query filters sign-in attempts from disabled accounts (ResultType 50057) in the last hour, but it only excludes two specific IP addresses. This means all other IP addresses (including legitimate ones) will trigger incidents, leading to many false positives. Option A is wrong because the query runs every hour, not too frequently. Option C is wrong because the query is valid. Option D is wrong because the query already filters by time.

Answer

The rule is configured to run too frequently.

Answer

The query uses 'ago(1h)' which includes data from the previous hour, causing duplicate incidents.

Answer

The query has a syntax error that causes all sign-ins to match.

Question 8

Refer to the exhibit. You are reviewing a custom Azure Policy definition used in Microsoft Defender for Cloud. The policy is intended to deploy a vulnerability assessment solution on SQL Managed Instances that do not have one. However, the policy is not being evaluated for any resources. What is the most likely reason?

Accepted Answer

The role definition ID specified in the deployment details does not have the necessary permissions to deploy the vulnerability assessment.. Option C is correct because the policy uses 'DeployIfNotExists' effect, which requires a managed identity with permissions to deploy the vulnerability assessment. The roleDefinitionIds must grant the necessary permissions. If the role definition ID is incorrect or the managed identity does not have permissions, the policy will not deploy. Option A is wrong because the policy condition checks for the absence of vulnerability assessment, so it should apply. Option B is wrong because the policy type is Custom, but custom policies can be assigned. Option D is wrong because the policy uses 'Microsoft.Sql/managedInstances' which is correct.

Answer

The policy type is set to 'Custom' instead of 'BuiltIn'.

Answer

The resource type in the policy condition is incorrect.

Answer

The policy condition checks for the existence of vulnerability assessment, but it should check for non-existence.

Question 9

Refer to the exhibit. You are assigning a built-in Azure Policy definition to a subscription using Azure CLI. The policy is 'Audit VMs that do not use managed disks'. After assignment, you check in Microsoft Defender for Cloud and see that the policy is not generating any recommendations. What is the most likely reason?

Accepted Answer

The policy is not part of a Defender for Cloud security initiative.. Option B is correct because Defender for Cloud only shows recommendations for policies that are part of its regulatory compliance or security benchmarks. A custom or built-in policy assigned directly via Azure Policy may not appear in Defender for Cloud unless it is included in a security initiative. Option A is wrong because the policy scope is correct. Option C is wrong because the policy effect is 'Audit', which generates compliance results. Option D is wrong because the policy assignment should work regardless of resource existence; it audits existing resources.

Answer

The policy effect is set to 'Audit', but it should be 'Deny' to generate recommendations.

Answer

The policy requires a managed identity to run.

Answer

The policy is assigned to the wrong subscription.

Question 10

A company uses Microsoft Defender for Cloud to secure its hybrid environment. The security team notices that many alerts are low severity and causing alert fatigue. They want to reduce noise without missing critical threats. What should they configure?

Accepted Answer

Configure security policies with severity-based suppression rules. Option C is correct because security policies with severity-based suppression rules allow filtering out low-severity alerts while keeping high-severity ones. Option A is wrong because disabling all low-severity alerts would miss potentially important indicators. Option B is wrong because manual suppression is not scalable. Option D is wrong because Microsoft Entra Permissions Management is for identity permissions, not alert suppression.

Answer

Manually dismiss each low-severity alert

Answer

Disable low-severity alerts in Microsoft Defender for Cloud

Answer

Enable Microsoft Entra Permissions Management

Question 11

A security analyst receives a Defender for Cloud alert indicating 'Malicious SQL injection attempt' on an Azure SQL Database. The analyst wants to immediately block the attacker's IP address at the network level using a just-in-time (JIT) VM access policy, but the SQL Database is not behind a VM. What should the analyst do to block the IP?

Accepted Answer

Create a firewall rule in Azure SQL Database's server-level firewall to deny the IP. Option D is correct because creating a firewall rule in Azure SQL Database's server-level firewall effectively blocks the IP. Option A is wrong because JIT VM access applies only to VMs. Option B is wrong because Azure Firewall is for virtual networks, not direct SQL access. Option C is wrong because changing the SQL Database's connection policy does not block specific IPs.

Answer

Add a network rule in Azure Firewall to deny the IP

Answer

Create a JIT VM access policy for the SQL Database server

Answer

Change the SQL Database's connection policy to 'Redirect'

Question 12

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to create a custom analytic rule that triggers an incident when a user signs in from an unfamiliar location. Which data source should you use?

Accepted Answer

Microsoft Entra ID Sign-in Logs. Option B is correct because Microsoft Entra ID (formerly Azure AD) sign-in logs contain location information and are commonly used for unfamiliar sign-in detection. Option A is wrong because Azure Activity logs record resource operations, not sign-ins. Option C is wrong because Azure AD audit logs track changes, not sign-ins. Option D is wrong because Microsoft 365 Defender alerts are not sign-in logs.

Answer

Azure Activity Logs

Answer

Azure AD Audit Logs

Answer

Microsoft 365 Defender Alerts

Question 13

A company has enabled Microsoft Defender for Cloud on all subscriptions. The security team wants to ensure that all virtual machines have vulnerability assessment solutions installed. What should they configure?

Accepted Answer

Enable the Vulnerability Assessment solution in Defender for Cloud and set it to 'On'. Option C is correct because Defender for Cloud's Vulnerability Assessment solution can be enforced via policy to auto-install on VMs. Option A is wrong because Azure Policy can enforce compliance but not automatically install. Option B is wrong because Azure Update Management is for OS updates, not vulnerability assessment. Option D is wrong because Azure Automation can run scripts but is not the recommended Defender solution.

Answer

Enable Azure Update Management for all VMs

Answer

Create an Azure Policy to audit VMs without vulnerability assessment

Answer

Use Azure Automation to run a script that installs a vulnerability scanner

Question 14

A financial services company uses Microsoft Sentinel to detect ransomware activity. They want to correlate alerts from multiple sources to reduce false positives. They have enabled Microsoft Defender for Cloud, Microsoft Defender XDR, and Azure Firewall logs. Which Sentinel feature should they use to create a single alert from multiple signals?

Accepted Answer

Fusion (machine learning) rules. Option D is correct because Fusion is a machine learning-based correlation engine that combines alerts from multiple sources to detect multi-stage attacks like ransomware. Option A is wrong because Scheduled query rules are for single data source queries. Option B is wrong because NRT rules provide near real-time but not correlation. Option C is wrong because Anomaly detection identifies unusual behavior but does not correlate across alerts.

Answer

Near-real-time (NRT) rules

Answer

Anomaly detection rules

Answer

Scheduled query rules

Question 15

Your organization uses Microsoft Defender for Cloud to protect Azure resources. You need to ensure that storage accounts are only accessible via HTTPS. What should you configure?

Accepted Answer

Enable 'Secure transfer required' in the storage account's configuration. Option B is correct because the storage account's security policy 'Secure transfer required' enforces HTTPS for all requests. Option A is wrong because Azure Policy can audit but not enforce the setting directly. Option C is wrong because a firewall rule controls network access, not protocol. Option D is wrong because private endpoints are for network isolation, not protocol enforcement.

Answer

Configure a storage account firewall to block HTTP

Answer

Use a private endpoint for the storage account

Answer

Create an Azure Policy to audit storage accounts that do not require secure transfer