AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 8 — 15 Questions

Question 1

A security analyst receives a Defender for Cloud alert indicating 'Malicious SQL injection attempt' on an Azure SQL Database. The analyst wants to immediately block the attacker's IP address at the network level using a just-in-time (JIT) VM access policy, but the SQL Database is not behind a VM. What should the analyst do to block the IP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a firewall rule in Azure SQL Database's server-level firewall to deny the IP. Azure SQL Database has its own server-level firewall that can be used to explicitly deny traffic from a specific IP address. Since the SQL Database is not behind a VM, a JIT VM access policy is irrelevant. Creating a firewall rule to deny the attacker's IP directly blocks the connection at the database network boundary, which is the appropriate network-level control for a PaaS SQL Database.

Answer

Add a network rule in Azure Firewall to deny the IP

Answer

Create a JIT VM access policy for the SQL Database server

Answer

Change the SQL Database's connection policy to 'Redirect'

Question 2

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to create a custom analytic rule that triggers an incident when a user signs in from an unfamiliar location. Which data source should you use?

Accepted Answer

Microsoft Entra ID Sign-in Logs. Microsoft Entra ID Sign-in Logs contain detailed information about user sign-in events, including location data. A custom analytic rule in Microsoft Sentinel can use these logs to detect sign-ins from unfamiliar locations by comparing the location against a user's typical sign-in pattern, which is a common UEBA (User and Entity Behavior Analytics) scenario.

Answer

Azure Activity Logs

Answer

Azure AD Audit Logs

Answer

Microsoft 365 Defender Alerts

Question 3

A company has enabled Microsoft Defender for Cloud on all subscriptions. The security team wants to ensure that all virtual machines have vulnerability assessment solutions installed. What should they configure?

Accepted Answer

Enable the Vulnerability Assessment solution in Defender for Cloud and set it to 'On'. Microsoft Defender for Cloud provides a built-in Vulnerability Assessment solution that can be enabled at the subscription level. When set to 'On', it automatically deploys the Qualys or Microsoft threat and vulnerability management agent to all supported Azure VMs, ensuring continuous vulnerability scanning without manual intervention.

Answer

Enable Azure Update Management for all VMs

Answer

Create an Azure Policy to audit VMs without vulnerability assessment

Answer

Use Azure Automation to run a script that installs a vulnerability scanner

Question 4

A financial services company uses Microsoft Sentinel to detect ransomware activity. They want to correlate alerts from multiple sources to reduce false positives. They have enabled Microsoft Defender for Cloud, Microsoft Defender XDR, and Azure Firewall logs. Which Sentinel feature should they use to create a single alert from multiple signals?

Accepted Answer

Fusion (machine learning) rules. Fusion (machine learning) rules in Microsoft Sentinel are specifically designed to correlate alerts from multiple sources—such as Microsoft Defender for Cloud, Microsoft Defender XDR, and Azure Firewall logs—by using machine learning models to identify multi-stage attack patterns and reduce false positives. This makes Fusion the correct choice for creating a single alert from multiple signals, as it automatically combines related alerts into a single, high-fidelity incident.

Answer

Near-real-time (NRT) rules

Answer

Anomaly detection rules

Answer

Scheduled query rules

Question 5

Your organization uses Microsoft Defender for Cloud to protect Azure resources. You need to ensure that storage accounts are only accessible via HTTPS. What should you configure?

Accepted Answer

Enable 'Secure transfer required' in the storage account's configuration. Enabling 'Secure transfer required' on a storage account enforces HTTPS for all requests to the storage account, rejecting any HTTP traffic. This setting ensures that data in transit is encrypted using TLS, which aligns with the requirement to only allow HTTPS access.

Answer

Configure a storage account firewall to block HTTP

Answer

Use a private endpoint for the storage account

Answer

Create an Azure Policy to audit storage accounts that do not require secure transfer

Question 6

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically respond to phishing emails detected by Microsoft Defender XDR. They want to create a playbook that, when triggered, will delete the email from all recipients' mailboxes. Which integration should the playbook use?

Accepted Answer

Microsoft Graph API. The Microsoft Graph API provides the necessary endpoints to programmatically access and manipulate Exchange Online mail items, including deleting emails from user mailboxes. A Sentinel playbook can use an HTTP trigger with the Graph API to perform the deletion action on behalf of the security team, enabling automated remediation of phishing emails across all recipients.

Answer

Microsoft Power Automate

Answer

Exchange Online PowerShell

Answer

Microsoft 365 Defender API

Question 7

A multinational corporation uses Microsoft Defender for Cloud to assess security posture across multiple subscriptions. The security team wants to ensure that all resources in a specific management group are compliant with a custom set of security standards. What should they do?

Accepted Answer

Assign a built-in or custom regulatory compliance standard to the management group in Defender for Cloud. Assigning a built-in or custom regulatory compliance standard directly to the management group in Microsoft Defender for Cloud (Option A) is the correct approach because it leverages Defender for Cloud's compliance dashboard, which provides control mapping, automated evidence collection, and centralized compliance monitoring. While Option D (creating an Azure Policy initiative and assigning it to the management group) would also enforce policies, it does not integrate with Defender for Cloud's compliance features, making Option A the more comprehensive and recommended solution.

Answer

Configure Defender for Cloud's security policy for each subscription individually

Answer

Use the Secure Score API to monitor compliance

Answer

Create an Azure Policy initiative and assign it to the management group

Question 8

A company uses Microsoft Sentinel to monitor Azure resources. They have a custom analytic rule that generates an incident when a user creates a new Azure SQL Database. The incident is assigned to the security team. However, they want to automatically notify the database administration team via email when such an incident is created. What should they configure?

Accepted Answer

Create an automation rule in Sentinel that runs a playbook to send an email. Automation rules in Microsoft Sentinel can be configured to run a playbook automatically when an incident is created. By attaching a playbook that sends an email (e.g., via Office 365 Outlook connector in Azure Logic Apps), the database administration team is notified without manual intervention. This is the native mechanism for incident-triggered automated responses in Sentinel.

Answer

Create a playbook in Azure Logic Apps that sends an email and attach it to the analytic rule

Answer

Configure a Microsoft Teams connector in the analytic rule

Answer

Create an Azure Monitor alert rule that triggers on the same query

Question 9

Which TWO of the following are valid methods to connect on-premises syslog data to Microsoft Sentinel?

Accepted Answer

Use the Azure Monitor Agent (AMA) with a data collection rule for syslog. The Azure Monitor Agent (AMA) with a data collection rule (DCR) for syslog is the current recommended method to collect syslog data from on-premises Linux servers into Microsoft Sentinel. The AMA uses a single agent that supports both Windows and Linux, and the DCR defines which syslog facilities and severities to collect, sending the data directly to a Log Analytics workspace. This replaces the legacy Log Analytics agent and provides a more secure, scalable, and manageable ingestion pipeline.

Answer

Use Azure Event Hubs to stream syslog data

Answer

Configure Azure Policy to collect syslog from on-premises servers

Answer

Deploy Azure Arc and enable the Log Analytics extension

Question 10

Which TWO of the following data connectors are available by default in Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (Option C) is a default data connector in Microsoft Sentinel because it provides native integration for streaming Azure AD audit logs and sign-in logs directly into Sentinel without requiring additional licensing or configuration beyond enabling the connector. This is a core Microsoft source that is automatically available in the Sentinel data connector gallery.

Answer

Palo Alto Networks

Answer

ServiceNow

Answer

Amazon Web Services (AWS)

Question 11

Your company uses Microsoft Defender for Cloud with the default auto-provisioning configuration. A security engineer reports that critical vulnerabilities in Azure Virtual Machines are being detected but not automatically remediated. The engineer wants to enable automatic remediation for all supported findings. What should the engineer configure?

Accepted Answer

Enable the 'Auto-provision vulnerability assessment' setting and configure an automation rule with a 'Remediate' action.. The default auto-provisioning configuration in Microsoft Defender for Cloud does not automatically remediate vulnerabilities; it only detects them. To enable automatic remediation, you must enable the 'Auto-provision vulnerability assessment' setting, which deploys the integrated Qualys or Microsoft vulnerability assessment solution to VMs, and then configure an automation rule with a 'Remediate' action, which triggers a Logic App to apply the necessary patches or configuration changes based on the vulnerability findings.

Answer

Configure an Azure Policy initiative with the 'Deploy if not exist' effect to automatically deploy the Log Analytics agent.

Answer

Enable Just-in-Time VM access for the affected virtual machines.

Answer

Create a Microsoft Sentinel playbook triggered by 'SecurityAlert' to run remediation commands.

Question 12

Your organization uses Microsoft Sentinel to detect threats across multiple Azure subscriptions. Security analysts need to query threat intelligence data from Microsoft Defender Threat Intelligence (MDTI) directly within Sentinel. However, analysts report that MDTI indicators are not appearing in ThreatIntelligenceIndicator table. What is the most likely cause?

Accepted Answer

The MDTI data connector is not enabled in Microsoft Sentinel.. The most likely cause is that the MDTI data connector is not enabled in Microsoft Sentinel. Without enabling this connector, threat intelligence indicators from Microsoft Defender Threat Intelligence will not be ingested into the ThreatIntelligenceIndicator table, regardless of other configurations. The connector must be explicitly installed and configured to pull MDTI data into the workspace.

Answer

The Sentinel workspace is located in a region where MDTI is not supported.

Answer

The subscriptions are not onboarded to Microsoft Defender for Cloud.

Answer

The Sentinel workspace is not using Azure Lighthouse for cross-subscription management.

Question 13

A company is deploying Microsoft Sentinel for the first time. The security team wants to ensure that all Azure activity logs, including data plane operations from Azure Storage, are ingested into Sentinel. Which data connector should they enable?

Accepted Answer

Azure Storage Account data connector. The Azure Storage Account data connector is designed to ingest storage diagnostics logs, including data plane operations (e.g., read, write, delete on blobs, tables, queues, files) into Microsoft Sentinel. While the Azure Activity log captures control plane operations (e.g., creating or deleting a storage account), it does not capture data plane operations within the storage account itself. Therefore, to meet the requirement of ingesting all Azure activity logs including data plane operations from Azure Storage, the Storage Account data connector must be enabled.

Answer

Azure Active Directory (now Microsoft Entra ID) data connector

Answer

Azure Key Vault data connector

Answer

Azure Activity log data connector

Question 14

Your organization uses Microsoft Defender for Cloud to manage security posture. You need to ensure that all Azure subscriptions have the 'MFA should be enabled on accounts with owner permissions' security control applied. The compliance dashboard shows this control as 'Unhealthy' for several subscriptions. What should you do to automatically remediate non-compliant subscriptions?

Accepted Answer

Create an Azure Policy initiative that enforces MFA for owner accounts and assign it to the subscriptions.. Azure Policy can enforce MFA for owner accounts at the subscription level by assigning a built-in or custom policy initiative. This ensures continuous compliance by automatically evaluating and remediating non-compliant subscriptions without manual intervention. Defender for Cloud uses Azure Policy as the underlying engine for security controls, so creating and assigning an initiative directly addresses the requirement.

Answer

Enable 'Enforce MFA' in Azure AD Conditional Access policy for all users.

Answer

Run a remediation task from Defender for Cloud for the non-compliant subscriptions.

Answer

Configure a Microsoft Sentinel playbook triggered by a compliance alert to add MFA.

Question 15

A security analyst receives a high-severity alert in Microsoft Sentinel indicating a potential brute-force attack against an Azure VM. The analyst wants to automatically block the attacker IP for 24 hours. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Sentinel that runs a playbook to add a deny NSG rule.. It leverages Microsoft Sentinel's automation rules to trigger a playbook that programmatically adds a deny Network Security Group (NSG) rule, blocking the attacker's IP for a specified duration. This is the most efficient approach as it automates the response without manual intervention, directly modifying the NSG attached to the VM's subnet to drop inbound traffic from the malicious IP.

Answer

Enable Just-in-Time VM access to restrict all RDP traffic.

Answer

Create an Azure Policy to deny all traffic from the attacker IP.

Answer

Manually add a deny rule to the NSG attached to the VM's subnet.