AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Practice Test 9 — 15 Questions

Question 1

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically respond to phishing emails detected by Microsoft Defender XDR. They want to create a playbook that, when triggered, will delete the email from all recipients' mailboxes. Which integration should the playbook use?

Accepted Answer

Microsoft Graph API. Option C is correct because Microsoft Graph API allows actions like deleting emails from mailboxes, and Sentinel playbooks can call Graph API. Option A is wrong because Microsoft 365 Defender API is for threat data, not mailbox actions. Option B is wrong because Exchange Online PowerShell is not directly callable from Sentinel playbooks. Option D is wrong because Microsoft Power Automate is the platform, not the integration.

Answer

Microsoft Power Automate

Answer

Exchange Online PowerShell

Answer

Microsoft 365 Defender API

Question 2

A multinational corporation uses Microsoft Defender for Cloud to assess security posture across multiple subscriptions. The security team wants to ensure that all resources in a specific management group are compliant with a custom set of security standards. What should they do?

Accepted Answer

Assign a built-in or custom regulatory compliance standard to the management group in Defender for Cloud. Option A is correct because regulatory compliance standards can be assigned at the management group level in Defender for Cloud. Option B is wrong because Azure Policy assignments are for individual policies, not security standards. Option C is wrong because security policies in Defender for Cloud are applied per subscription, not management group. Option D is wrong because Secure Score is a metric, not a compliance standard.

Answer

Configure Defender for Cloud's security policy for each subscription individually

Answer

Use the Secure Score API to monitor compliance

Answer

Create an Azure Policy initiative and assign it to the management group

Question 3

A company uses Microsoft Sentinel to monitor Azure resources. They have a custom analytic rule that generates an incident when a user creates a new Azure SQL Database. The incident is assigned to the security team. However, they want to automatically notify the database administration team via email when such an incident is created. What should they configure?

Accepted Answer

Create an automation rule in Sentinel that runs a playbook to send an email. Option B is correct because automation rules in Sentinel can trigger playbooks that send emails. Option A is wrong because Azure Monitor alerts are for metrics/logs, not Sentinel incidents. Option C is wrong because Logic Apps can send emails but need to be triggered by an automation rule. Option D is wrong because Microsoft Teams integration would require a playbook, not a direct connector.

Answer

Create a playbook in Azure Logic Apps that sends an email and attach it to the analytic rule

Answer

Configure a Microsoft Teams connector in the analytic rule

Answer

Create an Azure Monitor alert rule that triggers on the same query

Question 4

Which TWO of the following are valid methods to connect on-premises syslog data to Microsoft Sentinel?

Accepted Answer

Use the Azure Monitor Agent (AMA) with a data collection rule for syslog. Options A and C are correct. Option A: The Log Analytics agent (legacy) can forward syslog to Sentinel. Option C: The Azure Monitor Agent (AMA) with syslog data collection rules is the current recommended method. Option B is wrong because Event Hubs are used for CEF or custom logs, not raw syslog. Option D is wrong because Azure Policy does not collect logs. Option E is wrong because Azure Arc enables management but not directly syslog ingestion.

Answer

Use Azure Event Hubs to stream syslog data

Answer

Configure Azure Policy to collect syslog from on-premises servers

Answer

Deploy Azure Arc and enable the Log Analytics extension

Question 5

Which THREE of the following are features of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM)?

Accepted Answer

Security recommendations for resources. Options A, B, and D are correct. Option A: Secure Score is a core CSPM feature. Option B: Regulatory compliance assessments are part of CSPM. Option D: Security recommendations are a key output of CSPM. Option C is wrong because threat detection is part of Defender for Cloud's workload protection, not CSPM. Option E is wrong because vulnerability scanning is also a workload protection feature.

Answer

Vulnerability scanning of containers

Answer

Threat detection for VMs

Question 6

Which TWO of the following data connectors are available by default in Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID. Options C and D are correct. Option C: Azure Activity connector is built-in. Option D: Microsoft Entra ID (formerly Azure AD) connector is also built-in. Option A is wrong because ServiceNow connector is a premium connector. Option B is wrong because Amazon Web Services (AWS) connector is a premium connector. Option E is wrong because Palo Alto Networks connector is also premium.

Answer

Palo Alto Networks

Answer

ServiceNow

Answer

Amazon Web Services (AWS)

Question 7

Your company uses Microsoft Defender for Cloud with the default auto-provisioning configuration. A security engineer reports that critical vulnerabilities in Azure Virtual Machines are being detected but not automatically remediated. The engineer wants to enable automatic remediation for all supported findings. What should the engineer configure?

Accepted Answer

Enable the 'Auto-provision vulnerability assessment' setting and configure an automation rule with a 'Remediate' action.. Option B is correct because Defender for Cloud can automatically remediate vulnerabilities using a vulnerability assessment solution (like Qualys or Microsoft Defender Vulnerability Management) and an associated 'Automation' rule with a 'Remediate' action. Option A (Azure Policy 'Deploy if not exist' initiative) is used to deploy agents but not to auto-remediate findings. Option C (Just-in-Time VM access) controls network access, not vulnerability remediation. Option D (Microsoft Sentinel playbook) can remediate but requires custom automation, not automatic out-of-the-box.

Answer

Configure an Azure Policy initiative with the 'Deploy if not exist' effect to automatically deploy the Log Analytics agent.

Answer

Enable Just-in-Time VM access for the affected virtual machines.

Answer

Create a Microsoft Sentinel playbook triggered by 'SecurityAlert' to run remediation commands.

Question 8

Your organization uses Microsoft Sentinel to detect threats across multiple Azure subscriptions. Security analysts need to query threat intelligence data from Microsoft Defender Threat Intelligence (MDTI) directly within Sentinel. However, analysts report that MDTI indicators are not appearing in ThreatIntelligenceIndicator table. What is the most likely cause?

Accepted Answer

The MDTI data connector is not enabled in Microsoft Sentinel.. Option C is correct because MDTI data connectors must be enabled in Microsoft Sentinel, and if not, indicators will not populate the table. Option A (Azure Lighthouse) is unrelated. Option B (data connector disabled) is the correct reason but option C is more specific; however, among the choices, C is the most accurate as the connector must be enabled. Option D (subscription not onboarded to Defender for Cloud) does not affect Sentinel's threat intelligence.

Answer

The Sentinel workspace is located in a region where MDTI is not supported.

Answer

The subscriptions are not onboarded to Microsoft Defender for Cloud.

Answer

The Sentinel workspace is not using Azure Lighthouse for cross-subscription management.

Question 9

A company is deploying Microsoft Sentinel for the first time. The security team wants to ensure that all Azure activity logs, including data plane operations from Azure Storage, are ingested into Sentinel. Which data connector should they enable?

Accepted Answer

Azure Storage Account data connector. Option B is correct because Azure Activity log includes control plane operations; for data plane operations (e.g., blob reads), you need the Azure Storage Account data connector. Option A (Azure Activity) only covers control plane. Option C (Azure AD logs) is for identity. Option D (Azure Key Vault) is specific to Key Vault.

Answer

Azure Active Directory (now Microsoft Entra ID) data connector

Answer

Azure Key Vault data connector

Answer

Azure Activity log data connector

Question 10

Your organization uses Microsoft Defender for Cloud to manage security posture. You need to ensure that all Azure subscriptions have the 'MFA should be enabled on accounts with owner permissions' security control applied. The compliance dashboard shows this control as 'Unhealthy' for several subscriptions. What should you do to automatically remediate non-compliant subscriptions?

Accepted Answer

Create an Azure Policy initiative that enforces MFA for owner accounts and assign it to the subscriptions.. Option C is correct because you can create an Azure Policy initiative with a 'DeployIfNotExists' effect that enforces MFA on owner accounts. Option A (turn on 'Enforce MFA' in conditional access) applies to all users but not subscriptions automatically. Option B (remediation task) only fixes existing non-compliance but does not prevent future drift; however, it is part of the solution. Option D (Sentinel playbook) is custom and not automatic. The best approach is to use Azure Policy to enforce.

Answer

Enable 'Enforce MFA' in Azure AD Conditional Access policy for all users.

Answer

Run a remediation task from Defender for Cloud for the non-compliant subscriptions.

Answer

Configure a Microsoft Sentinel playbook triggered by a compliance alert to add MFA.

Question 11

A security analyst receives a high-severity alert in Microsoft Sentinel indicating a potential brute-force attack against an Azure VM. The analyst wants to automatically block the attacker IP for 24 hours. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Sentinel that runs a playbook to add a deny NSG rule.. Option D is correct because Sentinel automation rules can trigger a playbook that runs a script to add a network security group (NSG) rule to deny the IP. Option A (manual NSG rule) is not automatic. Option B (Azure Policy) is not designed for real-time blocking. Option C (JIT access) controls access, not blocking specific IPs.

Answer

Enable Just-in-Time VM access to restrict all RDP traffic.

Answer

Create an Azure Policy to deny all traffic from the attacker IP.

Answer

Manually add a deny rule to the NSG attached to the VM's subnet.

Question 12

Your organization uses Microsoft Defender for Cloud's workload protection for Azure SQL databases. You notice that Defender for Cloud is not generating alerts for anomalous activities on a specific SQL database. The database is in a VNet with a service endpoint enabled for SQL. What should you verify first?

Accepted Answer

Enable Advanced Threat Protection on the Azure SQL Server.. Option A is correct because the Advanced Threat Protection (ATP) must be enabled at the server level for Defender for Cloud to monitor it. Option B (auditing) is not required for ATP. Option C (service endpoint) does not block ATP. Option D (firewall rules) irrelevant.

Answer

Ensure the service endpoint is configured correctly.

Answer

Enable auditing on the SQL database.

Answer

Configure a firewall rule to allow Defender for Cloud IP addresses.

Question 13

Your security team uses Microsoft Sentinel's UEBA (User and Entity Behavior Analytics) to detect insider threats. To enable UEBA, which data source must be connected to Sentinel?

Accepted Answer

Microsoft Entra ID data connector. Option C is correct because UEBA in Sentinel requires the Microsoft Entra ID (Azure AD) data connector to ingest user identity and sign-in logs. Option A (Azure Activity) provides subscription-level logs. Option B (Azure AD) is correct. Option D (Office 365) is not required for UEBA.

Answer

Azure Key Vault data connector

Answer

Office 365 data connector

Answer

Azure Activity log data connector

Question 14

You manage a multi-tenant environment using Azure Lighthouse. You need to use Microsoft Defender for Cloud to monitor security posture across customer tenants. However, you cannot see the regulatory compliance dashboard for customer subscriptions. What is the most likely reason?

Accepted Answer

The 'Guest Configuration' extension is not installed on the customer's VMs.. Option B is correct because the regulatory compliance dashboard requires the Azure Policy Guest Configuration extension, which may not be auto-provisioned in delegated subscriptions. Option A (Azure Lighthouse not configured) is possible but less specific. Option C (tier) is not the issue. Option D (Log Analytics) is not required.

Answer

Azure Lighthouse is not configured for the customer tenants.

Answer

Defender for Cloud is not enabled on the customer subscriptions.

Answer

The Log Analytics agent is not deployed.

Question 15

Your organization uses Microsoft Sentinel and wants to create a custom analytics rule to detect failed logon attempts from a specific IP address. The rule should run every hour and look for the event in the SecurityEvent table. However, the rule never triggers even though the events exist. What is the most likely cause?

Accepted Answer

The Log Analytics agent is not installed on the machines generating the events.. Option A is correct because the SecurityEvent table requires the Log Analytics agent to be installed on the source machines, and if not, events won't be sent. Option B (permissions) would show an error. Option C (time range) is possible but unlikely. Option D (entity mapping) is not required for triggering.

Answer

The entity mapping in the rule is incomplete.

Answer

The analytics rule does not have the required permissions to query the workspace.

Answer

The rule query uses a time range that is too short.