AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 9 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud's workload protection for Azure SQL databases. You notice that Defender for Cloud is not generating alerts for anomalous activities on a specific SQL database. The database is in a VNet with a service endpoint enabled for SQL. What should you verify first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Advanced Threat Protection on the Azure SQL Server.. Defender for Cloud's workload protection for Azure SQL databases relies on Advanced Threat Protection (ATP) being enabled at the Azure SQL Server level. Without ATP enabled, Defender for Cloud cannot generate alerts for anomalous activities, regardless of network configurations like VNet service endpoints. Enabling ATP activates the threat detection engine that monitors SQL audit logs for suspicious patterns.

Answer

Ensure the service endpoint is configured correctly.

Answer

Enable auditing on the SQL database.

Answer

Configure a firewall rule to allow Defender for Cloud IP addresses.

Question 2

Your security team uses Microsoft Sentinel's UEBA (User and Entity Behavior Analytics) to detect insider threats. To enable UEBA, which data source must be connected to Sentinel?

Accepted Answer

Microsoft Entra ID data connector. Microsoft Sentinel's UEBA relies on Azure Active Directory (now Microsoft Entra ID) as the primary identity source to build behavioral baselines for users and entities. The Entra ID data connector ingests sign-in logs, audit logs, and risk detections, which are essential for UEBA to analyze patterns and detect anomalies indicative of insider threats. Without this identity telemetry, UEBA cannot establish the necessary behavioral profiles.

Answer

Azure Key Vault data connector

Answer

Office 365 data connector

Answer

Azure Activity log data connector

Question 3

You manage a multi-tenant environment using Azure Lighthouse. You need to use Microsoft Defender for Cloud to monitor security posture across customer tenants. However, you cannot see the regulatory compliance dashboard for customer subscriptions. What is the most likely reason?

Accepted Answer

The 'Guest Configuration' extension is not installed on the customer's VMs.. The regulatory compliance dashboard in Microsoft Defender for Cloud relies on guest-level configuration data collected via the Guest Configuration extension on Azure VMs. Without this extension, the dashboard cannot assess compliance against regulatory standards like SOC 2 or ISO 27001, even if Azure Lighthouse and Defender for Cloud are properly configured. Option D is correct because the Guest Configuration extension is required to gather the necessary in-guest policy data for compliance reporting.

Answer

Azure Lighthouse is not configured for the customer tenants.

Answer

Defender for Cloud is not enabled on the customer subscriptions.

Answer

The Log Analytics agent is not deployed.

Question 4

Your organization uses Microsoft Sentinel and wants to create a custom analytics rule to detect failed logon attempts from a specific IP address. The rule should run every hour and look for the event in the SecurityEvent table. However, the rule never triggers even though the events exist. What is the most likely cause?

Accepted Answer

The Log Analytics agent is not installed on the machines generating the events.. The SecurityEvent table is populated exclusively by the Log Analytics agent (formerly Microsoft Monitoring Agent) on Windows machines. If the agent is not installed on the machines generating the failed logon events, those events never reach the Log Analytics workspace, so the Sentinel analytics rule querying the SecurityEvent table will find zero results regardless of the rule's configuration.

Answer

The entity mapping in the rule is incomplete.

Answer

The analytics rule does not have the required permissions to query the workspace.

Answer

The rule query uses a time range that is too short.

Question 5

Which TWO actions can you perform using Microsoft Defender for Cloud's 'Security Alerts' page?

Accepted Answer

View the kill chain of an alert.. You can view the kill chain of an alert from the Security Alerts page. Option B is correct because you can suppress an alert (create suppression rules) from the Security Alerts page. Option C is incorrect because running a remediation script is not a built-in action on the Security Alerts page. Option D is incorrect because creating automation rules is done in Microsoft Sentinel, not directly on the Security Alerts page. Option E is incorrect because modifying the security policy is done via Azure Policy, not from Security Alerts.

Answer

Run a remediation script against the affected resource.

Answer

Create an automation rule to trigger a playbook.

Answer

Modify the security policy of the subscription.

Question 6

Which THREE features are part of Microsoft Defender XDR (formerly Microsoft 365 Defender) integration with Microsoft Sentinel?

Accepted Answer

Automatic triggering of Microsoft 365 Defender playbooks from Sentinel.. Microsoft Sentinel can automatically trigger playbooks (automated response workflows) when incidents or alerts are generated by Microsoft 365 Defender. This integration allows security teams to respond to threats across email, endpoint, and identity without manual intervention, leveraging Sentinel's orchestration capabilities.

Answer

Integration with Microsoft Defender for Cloud Apps to block downloads.

Answer

Integration with Microsoft Purview for data classification.

Question 7

Which TWO Microsoft Defender for Cloud plans specifically provide threat detection for Azure Storage?

Accepted Answer

Defender for Storage. Defender for Storage provides threat detection for Azure Storage by analyzing telemetry from data plane operations to detect anomalies such as unusual access patterns, potential malware uploads, and data exfiltration. Defender for Storage (classic) is the original plan that also offers threat detection for Azure Storage, though it lacks some features of the newer plan like malware scanning and sensitivity labeling. Both plans are specifically designed to protect Azure Storage accounts.

Answer

Defender for Servers

Answer

Defender for SQL

Answer

Defender for App Service

Question 8

Your security team receives an alert from Microsoft Defender for Cloud indicating 'Suspicious PowerShell script detected' on a virtual machine. The VM is running a critical application, and you need to investigate without disrupting the service. Which action should you take first?

Accepted Answer

Initiate a live response session from Microsoft Defender for Cloud.. Initiating a live response session from Microsoft Defender for Cloud allows you to remotely investigate the VM in real time without disrupting the critical application. Live response provides forensic tools (e.g., running scripts, collecting artifacts, examining processes) directly on the VM while it remains operational, which is essential for a production system. This aligns with the need to investigate the suspicious PowerShell script without taking the VM offline or impacting service availability.

Answer

Disconnect the VM from the virtual network.

Answer

Take a VM snapshot and analyze it offline.

Answer

Restart the VM to clear any malicious processes.

Question 9

You need to configure Microsoft Defender for Cloud to automatically remediate misconfigurations in Azure resources. Which feature should you enable?

Accepted Answer

Enable 'Remediate' on a built-in or custom policy initiative.. Microsoft Defender for Cloud's 'Remediate' feature on a built-in or custom policy initiative automatically applies corrective actions when a resource is found non-compliant with a security policy. This leverages Azure Policy's 'deployIfNotExists' or 'modify' effects to fix misconfigurations without manual intervention, directly addressing the requirement for automated remediation.

Answer

Configure security contacts to receive alert emails.

Answer

Create a workflow automation to run a Logic App on alerts.

Answer

Use the regulatory compliance dashboard to enforce standards.

Question 10

Your organization uses Microsoft Sentinel to detect threats across Azure, AWS, and on-premises environments. You need to create an analytics rule that will generate an incident when more than 10 failed logon attempts occur within 5 minutes from the same source IP. Which rule type should you use?

Accepted Answer

Near-real-time (NRT) rule. A Near-real-time (NRT) rule is designed to process streaming telemetry with minimal latency, making it ideal for detecting patterns like more than 10 failed logon attempts within 5 minutes from the same source IP. NRT rules evaluate events as they arrive in the Log Analytics workspace, typically within a 1-2 minute window, and can trigger incidents based on threshold conditions across a short time span without requiring a scheduled query.

Answer

Fusion rule

Answer

ML Behavior Analytics rule

Answer

Scheduled query rule

Question 11

Your company deploys a new Azure application gateway with WAF policy in prevention mode. After deployment, users report that legitimate traffic is being blocked. You need to identify which WAF rules are causing the blocks without affecting the security posture. What should you do?

Accepted Answer

Change the WAF policy mode to detection.. Switching the WAF policy mode from prevention to detection allows the application gateway to log WAF rule matches without blocking legitimate traffic. This enables you to review the logs and identify which specific rules are causing false positives, while still maintaining visibility into threats. Once identified, you can fine-tune the rules or create exceptions without disrupting the security posture.

Answer

Disable the WAF policy temporarily.

Answer

Create a custom rule to allow all traffic.

Answer

Set the WAF policy to custom rules only.

Question 12

You are configuring Microsoft Defender for Cloud for a multi-subscription environment. You need to ensure that security alerts are aggregated in a central location and that a single team can manage recommendations across all subscriptions. What should you use?

Accepted Answer

Assign a management group to aggregate security data.. By assigning Microsoft Defender for Cloud at the management group scope, security policies and alerts are aggregated across all subscriptions in that management group, enabling central management. Option A is incorrect because a resource group is a container for resources within a single subscription and does not provide cross-subscription aggregation. Option B is incorrect because a Log Analytics workspace can collect log data from multiple sources but does not inherently aggregate security alerts from Defender for Cloud across subscriptions; alerts are still generated per-subscription unless specific integration is configured. Option D is incorrect because creating a single subscription does not aggregate data from other subscriptions.

Answer

Use a resource group to collect all security resources.

Answer

Use a single Log Analytics workspace for all subscriptions.

Answer

Create a single subscription for all resources.

Question 13

You receive a Microsoft Defender for Cloud recommendation: 'Azure Policy Add-on for Kubernetes should be installed and enabled on your clusters'. The recommendation is marked as 'Unhealthy' for your AKS cluster. However, you have already installed the Azure Policy add-on. What is the most likely cause?

Accepted Answer

The AKS cluster does not have the 'azurepolicy' namespace.. The Azure Policy add-on for AKS requires a specific namespace named 'azurepolicy' to be present on the cluster. Even if the add-on is installed, if this namespace is missing or has been deleted, the add-on cannot function correctly, causing Microsoft Defender for Cloud to report the recommendation as 'Unhealthy'. The namespace is created automatically during the add-on installation, but manual deletion or a misconfiguration can lead to this state.

Answer

A custom Azure Policy initiative overrides the built-in one.

Answer

The cluster's network policy is blocking the add-on's webhook.

Answer

The Microsoft Defender for Cloud agent is not installed on the cluster.

Question 14

Your security operations center (SOC) uses Microsoft Sentinel. You need to ensure that an incident is automatically created when a specific type of alert fires from Microsoft Defender for Cloud. What is the most efficient way to configure this?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector in Sentinel and enable incident creation.. The Microsoft Defender for Cloud data connector in Microsoft Sentinel ingests alerts and automatically creates incidents based on the configured analytics rules, providing the most efficient integration. Option A is wrong because a playbook runs after incident creation and is not the most direct method. Option C is wrong because a workbook is for visualization and requires manual intervention. Option D is wrong because a scheduled analytics rule queries logs but does not directly connect to Defender for Cloud alerts in the same streamlined manner.

Answer

Create a playbook that triggers on alert and generates an incident via API.

Answer

Design a workbook to monitor alerts and manually create incidents.

Answer

Write a scheduled analytics rule that queries Defender for Cloud logs.

Question 15

You need to enable Microsoft Defender for Cloud's enhanced security features for an Azure subscription. Which of the following is required?

Accepted Answer

Enable 'Microsoft Defender for Cloud' at the subscription level.. To enable Microsoft Defender for Cloud's enhanced security features, you must enable 'Microsoft Defender for Cloud' at the subscription level. This action activates the Defender plans (e.g., Defender for Servers, Defender for SQL) for the entire subscription, allowing you to then configure individual plans as needed. Without this subscription-level enablement, the enhanced security capabilities remain off by default.

Answer

Enable all Defender plans at once.

Answer

Deploy a Log Analytics workspace in the same region.

Answer

Assign an Azure Policy to enforce Defender for Cloud.