AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 8 — 15 Questions

Question 1

You are a security architect for a large enterprise with 500 Azure subscriptions organized into a management group hierarchy. The company uses Microsoft Defender for Cloud to assess security posture. The CISO wants a single dashboard view of the secure score across all subscriptions, but with the ability to drill down into individual management groups. You need to recommend a solution that provides this capability with minimal administrative overhead. The company already has Log Analytics workspaces deployed per region. Which approach should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Microsoft Defender for Cloud dashboard in the Azure portal, selecting the root management group to view aggregated score. The Microsoft Defender for Cloud dashboard in the Azure portal natively supports management group scoping. When you select the root management group, it aggregates the secure score across all 500 subscriptions and allows you to drill down into individual management groups without any additional configuration. This provides the required single dashboard view with minimal administrative overhead, leveraging built-in Azure capabilities.

Answer

Export the secure score to a Log Analytics workspace and create a custom workbook

Answer

Integrate Defender for Cloud with Microsoft Power BI and create a report

Answer

Use the Microsoft Defender for Cloud REST API to retrieve the secure score and build a custom dashboard

Question 2

A company uses Microsoft Defender for Cloud to protect Azure resources. The security team wants to automatically remediate certain recommendations without manual intervention. They decide to use Azure Policy to enforce secure configurations. Which feature in Defender for Cloud allows them to create policy assignments directly from the recommendation?

Accepted Answer

Enforce. The 'Enforce' button on a recommendation allows creating a policy assignment that enforces the recommendation via Azure Policy. Option A is wrong because 'Quick fix' remediates a single resource, not enforces policy. Option B is wrong because 'Assign policy' button directly does this; 'View policy definition' only shows the definition. Option D is wrong because 'Remediate' triggers a remediation task on existing resources, not enforcing policy on new resources.

Answer

Remediate

Answer

View policy definition

Answer

Quick fix

Question 3

Your company uses Microsoft Defender for Cloud to monitor Azure and on-premises servers. The security team wants to ensure that all supported machines are receiving vulnerability assessments using a built-in scanner that does not require deploying an agent or additional software. You need to enable this capability with the least operational overhead. What should you do?

Accepted Answer

Enable the Microsoft Defender for Servers plan and ensure the vulnerability assessment solution is set to 'Microsoft Defender for Endpoint'.. Microsoft Defender for Servers offers agentless vulnerability assessment through integration with Microsoft Defender for Endpoint. By enabling the Defender for Servers plan and selecting 'Microsoft Defender for Endpoint' as the vulnerability assessment solution, you avoid deploying additional agents or extensions. This built-in capability provides vulnerability data with minimal operational effort.

Answer

Configure a custom Azure Policy that deploys the vulnerability assessment extension to all machines.

Answer

Deploy the Microsoft Defender for Cloud integrated Qualys scanner by installing the extension on each machine.

Answer

Enable the Microsoft Defender for Containers plan to get vulnerability assessment for all servers.

Question 4

Your organization uses Microsoft Defender for Cloud to monitor Azure and on-premises resources. You need to ensure that all high-severity alerts are automatically investigated and remediated where possible. You configure a workflow automation that triggers on alerts. Which of the following must you configure to allow the workflow to run?

Accepted Answer

A logic app with a system-assigned managed identity that has the Contributor role on the target resources.. Workflow automation in Microsoft Defender for Cloud is built on Azure Logic Apps. To execute remediation actions, the logic app must have a managed identity with sufficient permissions on the affected resources. A system-assigned managed identity with the Contributor role provides the necessary rights to modify resources while avoiding the use of overly privileged user accounts. This aligns with the principle of least privilege and enables automated response.

Answer

A logic app with a managed identity that has the Security Reader role on the subscription.

Answer

A logic app with an API connection to Azure Monitor that uses a service principal with the Monitoring Contributor role.

Answer

A logic app with an Office 365 connector and a user account that has Global Administrator role.

Question 5

Your organization uses Microsoft Sentinel to monitor security events. You need to create a scheduled analytics rule that generates an incident only when a specific user account is added to a privileged Microsoft Entra ID role. The rule must run every 5 minutes. Which query should you use?

Accepted Answer

AuditLogs | where OperationName == "Add member to role" | where TargetResources[0].userPrincipalName == "privilegeduser@contoso.com". The AuditLogs table in Microsoft Sentinel contains Microsoft Entra ID audit events. The operation "Add member to role" indicates a role assignment, and TargetResources includes the user and role details. Filtering on the target user's userPrincipalName correctly identifies when that specific account is added to a privileged role. The other queries either target the wrong table, filter on the wrong field, or miss the role assignment context.

Answer

AuditLogs | where OperationName == "Add member to role" | where TargetResources has "Global Administrator"

Answer

SigninLogs | where UserPrincipalName == "privilegeduser@contoso.com" | where ResultType == "0"

Answer

SecurityEvent | where Activity contains "Group Membership" | where Account contains "privilegeduser"

Question 6

You are configuring Microsoft Sentinel to detect suspicious activities in your Azure environment. You want to create an analytics rule that uses entity mapping to enrich incidents. Which TWO entity types can you map directly from the query results in an analytics rule? (Choose two.)

Accepted Answer

Account. Microsoft Sentinel analytics rules allow you to map query result fields to specific entity types to enrich incidents. The supported entity types include Account, Host, IP address, URL, File, and others. Mapping these entities enables analysts to see contextual information and pivot to related events. Account and IP address are both directly supported and commonly used in detections. File hash, Cloud application, and Registry key are not available as entity types in the analytics rule mapping configuration.

Answer

Cloud application

Answer

File hash

Answer

Registry key

Question 7

You are configuring Microsoft Defender for Cloud to protect your Azure environment. You need to enable advanced threat protection for specific resource types. Which two features can you enable? (Choose two.)

Accepted Answer

Defender for Servers. Microsoft Defender for Cloud offers several plans for advanced threat protection, including Defender for Servers and Defender for Storage. These plans can be enabled independently to protect those resource types. Defender for DNS and Defender for Key Vault are not standalone plans, and Defender for Containers, while valid, is not one of the two features that directly match the scenario's requirement for servers and storage.

Answer

Defender for DNS

Answer

Defender for Containers

Answer

Defender for Key Vault

Question 8

You are using Microsoft Sentinel to investigate an incident. You need to identify which two actions can be performed directly from the incident page to enrich the investigation. (Choose two.)

Accepted Answer

Use the investigation graph to explore relationships between entities and expand the incident scope.. The investigation graph allows visual exploration of entity relationships, and running a playbook can automate enrichment tasks like querying VirusTotal. Both are directly accessible from the incident page and enhance the investigation. The other options are either not available from the incident page or do not provide enrichment.

Answer

Add a comment to the incident with your findings and tag another analyst.

Answer

Modify the analytics rule that generated the incident to exclude similar future alerts.

Answer

Delete the incident and create a new one with updated severity.

Question 9

You are a security engineer for a company that uses Microsoft Defender for Cloud. You have enabled the Defender for Servers plan. You need to ensure that file integrity monitoring (FIM) is enabled for critical files on your Azure virtual machines. What should you do?

Accepted Answer

In Microsoft Defender for Cloud, go to Environment settings, select the subscription, and under Defender plans, enable File Integrity Monitoring for the Servers plan.. To enable file integrity monitoring for Azure VMs, you must configure it within Microsoft Defender for Cloud. After enabling the Defender for Servers plan, you go to Environment settings, select the relevant subscription, and under the Defender plans settings, enable File Integrity Monitoring. This action deploys the required agent and configures the workspace to collect FIM data. It is the native and correct way to activate FIM in Defender for Cloud, ensuring critical file changes are tracked and alerted.

Answer

Create an Azure Policy assignment that deploys the Dependency Agent extension to all virtual machines and then configure data collection rules in Azure Monitor.

Answer

Configure the Log Analytics workspace to collect the 'Common' security events and enable the FIM solution from the Microsoft Sentinel content hub.

Answer

Enable the Microsoft Defender for Endpoint integration and configure attack surface reduction rules to monitor file changes.

Question 10

Your company uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions in a management group are automatically onboarded to Defender for Cloud with the same security policy. What should you do?

Accepted Answer

Assign a custom Azure Policy initiative to the management group that enforces the Defender for Cloud pricing tier and security contacts.. Azure Policy assigned at the management group scope applies to all subscriptions within that group. Using a policy initiative to enforce the Defender for Cloud pricing tier and security contacts ensures automatic, consistent onboarding. This declarative approach is scalable and aligns with Azure governance best practices. Other options require manual effort or custom automation and do not enforce policy at scale.

Answer

Create an Azure Blueprint that includes the Defender for Cloud configuration and assign it to the management group.

Answer

Enable Defender for Cloud on each subscription manually and then use a Logic App to copy the security policy.

Answer

Use Azure Lighthouse to delegate access to all subscriptions and then configure Defender for Cloud from a central subscription.

Question 11

Your company uses Microsoft Defender for Cloud to monitor Azure and on-premises servers. You have enabled the Defender for Servers plan. A security analyst needs to investigate a suspicious process execution on an Azure virtual machine. The analyst wants to see the full command line and the parent process of the executed process. Which Defender for Cloud feature provides this information?

Accepted Answer

Fileless attack detection. Defender for Servers includes fileless attack detection, which collects detailed process execution telemetry, including command lines and parent process information. This data is surfaced in security alerts and can be investigated using the security graph or advanced hunting. It is specifically designed to detect and provide forensic details for suspicious process activities, making it the correct choice.

Answer

Adaptive application controls

Answer

Just-in-time VM access

Answer

File integrity monitoring

Question 12

You are a security engineer for a company that uses Microsoft Defender for Cloud. The company has a hybrid environment with Azure VMs and on-premises servers onboarded to Microsoft Defender for Servers. You need to ensure that file integrity monitoring (FIM) is enabled on all these servers to track changes to critical system files. What should you do?

Accepted Answer

Deploy the Azure Monitor Agent (AMA) to all servers and create a Data Collection Rule (DCR) that includes the 'File Integrity Monitoring' data source.. File Integrity Monitoring in Microsoft Defender for Cloud requires the Azure Monitor Agent (AMA) and a Data Collection Rule (DCR) that defines the FIM data source. This approach works for both Azure and on-premises servers onboarded to Defender for Servers. Enabling the feature in the portal alone is insufficient; you must deploy AMA and create a DCR that specifies the files and registry keys to monitor.

Answer

Enable the File Integrity Monitoring (FIM) feature in Microsoft Defender for Cloud and configure the workspace to collect security events.

Answer

Use Azure Policy to enable the 'File Integrity Monitoring' extension on all servers and link them to a Log Analytics workspace.

Answer

Install the Log Analytics agent (MMA) on all servers and enable the 'File Integrity Monitoring' solution from the Azure Marketplace.

Question 13

Your company uses Microsoft Sentinel with a Log Analytics workspace. You need to create an analytics rule that generates an incident when a specific security event occurs more than 10 times within 5 minutes from the same source IP. The rule should group all occurrences into a single incident. Which configuration should you use?

Accepted Answer

Use a scheduled query rule with a query that summarizes count by source IP over 5 minutes, and set the threshold to greater than 10.. A scheduled analytics rule with a summarizing query that counts events per source IP over a 5-minute window and a threshold of greater than 10 will generate a single incident when the condition is met. This allows grouping of all occurrences into one incident. Other rule types like NRT or Fusion do not support the required custom aggregation and threshold configuration.

Answer

Configure a near-real-time (NRT) rule with a query that counts events and set the threshold to greater than 10.

Answer

Set 'Event grouping' to 'Group all events into a single alert' and configure the query to aggregate by source IP.

Answer

Create a fusion rule that automatically detects multi-stage attacks and groups related alerts.

Question 14

You are responsible for securing an Azure subscription using Microsoft Defender for Cloud. You need to ensure that all recommendations related to unpatched vulnerabilities on virtual machines are automatically remediated. Which approach should you use?

Accepted Answer

Use Azure Policy to deploy the Guest Configuration extension and assign the 'System updates should be installed on your machines' policy with a remediation task.. Azure Policy with the Guest Configuration extension provides automated remediation for system updates on VMs. Assigning the built-in policy and creating a remediation task ensures that missing updates are installed automatically. This is the recommended approach for enforcing patch compliance at scale, as it integrates with Defender for Cloud and provides continuous assessment and remediation.

Answer

Enable the 'Auto provision' setting for the Log Analytics agent and configure a remediation logic app.

Answer

Configure a workflow automation in Defender for Cloud to trigger a Logic App that runs a PowerShell script to install updates.

Answer

Enable just-in-time (JIT) VM access to prevent unauthorized changes and ensure updates are applied.

Question 15

You are a security analyst using Microsoft Sentinel. You need to create a scheduled analytics rule that generates an incident when a specific Windows security event ID (4625) is detected more than 10 times within 5 minutes from the same account. The rule should not generate duplicate incidents for the same account within the 5-minute window. What should you configure?

Accepted Answer

Set the rule's query period to 5 minutes, set the trigger threshold to 10, and enable the suppression setting with a duration of 5 minutes.. In Microsoft Sentinel, scheduled analytics rules include a suppression setting that, when enabled, prevents the rule from generating additional alerts for a specified duration after an alert is created. Setting the suppression duration to 5 minutes ensures that no duplicate incidents are generated for the same account within that window, directly fulfilling the requirement.

Answer

Set the rule's query period to 5 minutes, set the trigger threshold to 10, and configure the rule to stop running after an alert is generated.

Answer

Set the rule's query period to 5 minutes, set the trigger threshold to 10, and configure the incident settings to merge related incidents.

Answer

Set the rule's query period to 5 minutes, set the trigger threshold to 10, and enable event grouping.