AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 9 — 15 Questions

Question 1

You are a security engineer for a company that uses Microsoft Defender for Cloud. You have enabled Microsoft Defender for Containers on an Azure Kubernetes Service (AKS) cluster. You need to ensure that any pod that attempts to run with a privileged security context is detected and generates a security alert. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure that Microsoft Defender for Containers is enabled and that the AKS cluster has the Defender profile installed. Defender for Containers will automatically detect privileged pod attempts and generate alerts.. Microsoft Defender for Containers provides runtime threat detection for AKS clusters, including detection of privileged pod attempts. When the Defender profile is installed on the cluster, it monitors audit logs and runtime events, automatically generating alerts for suspicious activities such as privileged container creation. This built-in capability meets the requirement without custom configuration.

Answer

Configure Kubernetes audit logs to be sent to a Log Analytics workspace and create a custom alert rule that triggers when a pod with privileged: true is created.

Answer

Enable the Azure Policy add-on for AKS and assign the 'Kubernetes cluster pod security baseline standards for Linux-based workloads' policy.

Answer

Enable the Azure Policy add-on for AKS and assign the 'Kubernetes cluster containers should not share host process between an operating system and container' policy.

Question 2

You are configuring Microsoft Defender for Cloud to protect an Azure Kubernetes Service (AKS) cluster. You need to enable features that provide runtime threat detection and vulnerability assessment for container images. (Choose two.)

Accepted Answer

Enable the Microsoft Defender for Containers plan.. To achieve runtime threat detection and vulnerability assessment for container images in AKS, you must enable the Microsoft Defender for Containers plan. This plan provides both capabilities: runtime detection through a security sensor on AKS nodes and vulnerability assessment via integration with Azure Container Registry. Enabling the ACR vulnerability scanning feature is also required for image scanning. Other options do not provide these specific security features.

Answer

Install the Azure Policy add-on for AKS.

Answer

Enable the Microsoft Defender for Servers plan.

Answer

Configure the Azure Monitor Agent to collect Kubernetes audit logs.

Question 3

You are a security analyst using Microsoft Sentinel. You need to configure a playbook that automatically enriches incidents with threat intelligence from Microsoft Defender Threat Intelligence (MDTI) and then posts a message to a Microsoft Teams channel. The playbook must be triggered when an incident is created. Which two actions should you perform? (Choose two.)

Accepted Answer

Create an automation rule that triggers on incident creation and runs the playbook.. To automatically run a playbook on incident creation, you need an automation rule that triggers on incident creation and runs the playbook. The playbook itself must include the actions to enrich with threat intelligence and post to Teams. This combination ensures the playbook is invoked automatically and performs the required tasks.

Answer

Create a scheduled query rule that runs every 5 minutes to check for new incidents and trigger the playbook.

Answer

Configure the analytics rule that generates the incident to run the playbook as an automated response.

Answer

Enable the Microsoft Defender Threat Intelligence connector in Microsoft Sentinel and configure it to enrich incidents automatically.

Question 4

A company uses Microsoft Defender for Cloud to manage the security posture of multiple Azure subscriptions. The security team wants to ensure that all subscriptions are covered by the same Microsoft Defender for Cloud policy initiative, but one subscription is not showing compliance data. The subscription is in the same Azure AD tenant and has the same tags. What is the most likely cause?

Accepted Answer

The subscription is not registered with the Microsoft.Security resource provider.. Microsoft Defender for Cloud relies on the Microsoft.Security resource provider to collect security configurations, apply policy initiatives, and report compliance data. If a subscription is not registered with the Microsoft.Security resource provider, Defender for Cloud cannot evaluate policies or generate compliance results, even if the subscription is in the same tenant and has identical tags. Registering the resource provider is a prerequisite for any Defender for Cloud functionality, including policy assignment and compliance reporting.

Answer

The user does not have Security Admin permissions on the subscription.

Answer

The subscription does not have any tags applied.

Answer

The subscription does not have the default policy initiative assigned.

Question 5

Your company uses Microsoft Sentinel to monitor security events. You need to detect brute-force attacks against Azure VMs that are not yet onboarded to Sentinel. What should you do?

Accepted Answer

Use the Windows Security Events connector via Azure Monitor Agent.. The Windows Security Events connector via Azure Monitor Agent can collect security event logs from Azure VMs, including failed logon attempts that indicate brute-force attacks. Since the VMs are not yet onboarded to Sentinel, this connector allows you to ingest their existing Windows Event Logs (specifically Event ID 4625 for failed logons) directly into Sentinel for detection and alerting.

Answer

Use the Office 365 connector to collect sign-in logs.

Answer

Use the Common Event Format connector to forward syslog.

Answer

Use the Azure Activity connector to collect sign-in logs.

Question 6

A security team uses Microsoft Defender for Cloud's regulatory compliance dashboard to track compliance with PCI DSS. They notice that some controls are marked as 'N/A' even though they have relevant resources. What is the most likely reason?

Accepted Answer

The resources are in a subscription that is not included in the scope of the compliance standard.. The correct answer is C: resources in a subscription that is not included in the scope of the compliance standard. In Microsoft Defender for Cloud's regulatory compliance dashboard, a control is shown as 'N/A' when the standard's assessment scope does not cover the subscription containing those resources, so the control is not evaluated against them. This scoping is configured when assigning the regulatory compliance standard, and only in-scope subscriptions are assessed. Option A is incorrect because a missing custom assessment would leave a control unassessed or healthy/unhealthy, not scoped out as N/A. Option B is incorrect because the regulatory compliance dashboard is a Defender for Cloud capability and does not require a Microsoft Purview Compliance Manager license. Option D is incorrect because manual attestation affects a control's compliance state, not whether it is marked N/A due to scope.

Answer

The resources do not have the required custom assessment.

Answer

The compliance dashboard requires a Microsoft Purview Compliance Manager license.

Answer

The resources have not been manually claimed as compliant.

Question 7

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory. Which two data connectors are necessary to collect sign-in logs and audit logs?

Accepted Answer

Azure Active Directory Sign-in logs and Azure Active Directory Audit logs. To collect sign-in logs and audit logs in Microsoft Sentinel, you need the Microsoft Entra ID Sign-in logs connector for sign-in activity and the Microsoft Entra ID Audit logs connector for directory changes and user management events. These two connectors directly correspond to the two log categories required by the question.

Answer

Azure Activity and Azure Active Directory Audit logs

Answer

Office 365 and Azure Active Directory Sign-in logs

Answer

Security Events and Azure Active Directory Sign-in logs

Question 8

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

To list the top 10 most frequent alert names along with their severity over the last 7 days.. The KQL query uses the `summarize` operator to group alerts by `AlertName` and `Severity`, then sorts by `count_` in descending order and takes the top 10 results. This produces a list of the 10 most frequent alert names along with their severity over the last 7 days, matching option B.

Answer

To list all alerts with severity 'High' in the last 7 days.

Answer

To list all alerts generated in the last 7 days.

Answer

To list the count of alerts per severity for the last 7 days.

Question 9

Refer to the exhibit. This is an excerpt from an Azure Policy assignment. What is the effect of the 'notScopes' property?

Accepted Answer

The policy will apply to all resources in RG-Prod except the VM-Sensitive virtual machine.. 'notScopes' excludes specific sub-scopes from the policy assignment. In this case, the policy applies to all resources in 'RG-Prod' except the VM named 'VM-Sensitive'. Option A is wrong because 'notScopes' do not add resources. Option B is wrong because it does not remove the entire resource group. Option D is wrong because it does not affect subscription-level exclusions.

Answer

The policy will apply only to the VM-Sensitive virtual machine.

Answer

The policy will apply to all resources in RG-Prod except the entire resource group.

Answer

The policy will apply to the subscription but not to RG-Prod.

Question 10

Your organization uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions have the 'Auto-provisioning' extension enabled for Log Analytics agent on new VMs. What should you configure?

Accepted Answer

Enable 'Auto-provisioning' in Defender for Cloud's environment settings.. Defender for Cloud's environment settings include a dedicated 'Auto-provisioning' toggle for the Log Analytics agent. When enabled, Defender for Cloud automatically installs the agent on any new Azure VM that is provisioned in the selected subscriptions, ensuring continuous monitoring without manual intervention. This is the native mechanism within Defender for Cloud to enforce agent deployment at scale.

Answer

Configure Azure Automation State Configuration to push the agent.

Answer

Set up data connectors in Microsoft Sentinel.

Answer

Create an Azure Policy assignment to deploy the Log Analytics agent.

Question 11

Your company has a hybrid environment with on-premises servers and Azure VMs. All resources are onboarded to Microsoft Defender for Cloud. You need to receive alerts when a critical vulnerability is detected on any server. The security team wants to minimize false positives. What should you configure?

Accepted Answer

Enable vulnerability assessment for servers via the integrated VA solution.. Microsoft Defender for Cloud's integrated vulnerability assessment (VA) solution, powered by Qualys or Microsoft Defender Vulnerability Management, continuously scans servers for known CVEs and generates security alerts when critical vulnerabilities are found. This directly meets the requirement to receive alerts on critical vulnerabilities while minimizing false positives, as the VA solution uses curated, verified vulnerability data rather than heuristic or behavioral detections that might produce noise.

Answer

Configure just-in-time VM access to reduce attack surface.

Answer

Enable adaptive application controls to detect unapproved software.

Answer

Enable file integrity monitoring on critical files.

Question 12

You are investigating a security incident in Microsoft Sentinel. A KQL query returns results indicating that a user logged in from an IP address that is not in the organization's approved list. The user's account has been compromised. You need to automatically disable the user account in Microsoft Entra ID when such an alert is triggered. What should you configure?

Accepted Answer

Create a playbook in Microsoft Sentinel with a Logic Apps connector to Microsoft Entra ID.. Microsoft Sentinel can use playbooks, which are automated workflows built on Azure Logic Apps, to respond to security alerts. By creating a playbook triggered by a Sentinel alert, you can use the Microsoft Entra ID connector to automatically disable a compromised user account, providing a direct and integrated remediation action.

Answer

Configure an Azure Policy that disables the user account.

Answer

Use Microsoft Defender for Cloud to automatically disable the account.

Answer

Create a Power Automate flow triggered by the Sentinel alert.

Question 13

Your organization is using Microsoft Defender for Cloud to protect Azure SQL databases. You need to enable Advanced Threat Protection (ATP) for all existing and future Azure SQL databases in a subscription. The solution must minimize administrative effort. What should you do?

Accepted Answer

Enable the Azure SQL databases plan in Microsoft Defender for Cloud at the subscription level.. Enabling the Azure SQL databases plan in Microsoft Defender for Cloud at the subscription level automatically enables Advanced Threat Protection (ATP) for all existing and future Azure SQL databases within that subscription. This approach requires minimal administrative effort because it applies the protection globally without needing to configure each database individually or create custom policies. Microsoft Defender for Cloud manages the ATP settings centrally, ensuring consistent security coverage across the entire subscription.

Answer

Configure Microsoft Sentinel to monitor Azure SQL databases.

Answer

Create an Azure Policy to deploy Advanced Threat Protection on Azure SQL databases.

Answer

Enable Advanced Threat Protection on each Azure SQL database individually.

Question 14

Your company has multiple Azure subscriptions. You need to centralize security alerts and incidents in a single dashboard for the security operations center (SOC) team. The solution should provide advanced analytics and threat detection. Which service should you use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that centralizes security alerts and incidents from multiple Azure subscriptions into a single dashboard. It provides advanced analytics, built-in threat detection, and AI-driven investigation capabilities, making it ideal for a SOC team requiring a unified view across the enterprise.

Answer

Azure Monitor

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Cloud

Question 15

You are configuring Microsoft Defender for Cloud's continuous export feature. You need to export security alerts and recommendations to a Log Analytics workspace for long-term retention and custom analysis. The export should include only high-severity alerts and recommendations. What should you do?

Accepted Answer

Enable continuous export in Defender for Cloud and select high-severity alerts and recommendations.. Microsoft Defender for Cloud's continuous export feature allows you to directly export security alerts and recommendations to a Log Analytics workspace with granular filtering by severity. This meets the requirement for long-term retention and custom analysis without additional services. Selecting 'high-severity' in the export configuration ensures only the specified alerts and recommendations are exported.

Answer

Set up Microsoft Sentinel to ingest Defender for Cloud alerts and then export to the workspace.

Answer

Configure diagnostic settings on each Azure resource to send logs to the workspace.

Answer

Use Azure Event Hubs to stream security alerts to the workspace.