AZ-500 Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel — Timed 50 Questions

Question 1

A company uses Microsoft Defender for Cloud to manage the security posture of multiple Azure subscriptions. The security team wants to ensure that all subscriptions are covered by the same Microsoft Defender for Cloud policy initiative, but one subscription is not showing compliance data. The subscription is in the same Azure AD tenant and has the same tags. What is the most likely cause?

Accepted Answer

The subscription is not registered with the Microsoft.Security resource provider.. Option C is correct because a subscription must be registered with the Microsoft Defender for Cloud resource provider (Microsoft.Security) to be assessed. Option A is wrong because user permissions do not affect compliance data generation. Option B is wrong because tags are not required for compliance scanning. Option D is wrong because the default policy initiative applies automatically; there is no need to assign it manually.

Answer

The user does not have Security Admin permissions on the subscription.

Answer

The subscription does not have any tags applied.

Answer

The subscription does not have the default policy initiative assigned.

Question 2

An organization uses Microsoft Defender for Cloud to protect Azure virtual machines. They notice that several VMs are not receiving vulnerability assessment findings, even though they are in a scope where the integrated Qualys VA solution is enabled. What should they verify first?

Accepted Answer

The VM does not have the Log Analytics agent installed.. Option B is correct because if the VM does not have the Log Analytics agent (or Azure Monitor Agent) installed, the Qualys extension cannot communicate findings. Option A is wrong because the vulnerability assessment solution is deployed at the subscription level, not per VM. Option C is wrong because the Qualys solution is included with Defender for Servers P2; no separate license is needed. Option D is wrong because network security groups are not the primary reason for missing findings; the agent is required.

Answer

The VM is in a resource group that is excluded from the vulnerability assessment solution.

Answer

The VM is behind a network security group that blocks outbound traffic.

Answer

The VM does not have a valid Qualys license.

Question 3

A security analyst needs to create a custom alert in Microsoft Defender for Cloud that triggers when a user creates a public IP address in the 'production' resource group. Which type of alert should they use?

Accepted Answer

Custom recommendation based on Azure Policy. Option D is correct because custom alerts in Defender for Cloud are created using custom recommendations based on Azure Policy. Option A is wrong because Azure Activity Log alerts are in Azure Monitor, not Defender for Cloud. Option B is wrong because Azure Sentinel analytics rules are for Sentinel, not Defender for Cloud. Option C is wrong because Microsoft Defender for Cloud does not have native custom alert rules via a portal wizard; it uses Azure Policy.

Answer

Azure Sentinel analytics rule

Answer

Azure Activity Log alert

Answer

Custom alert rule in Defender for Cloud

Question 4

Your company uses Microsoft Sentinel to monitor security events. You need to detect brute-force attacks against Azure VMs that are not yet onboarded to Sentinel. What should you do?

Accepted Answer

Use the Windows Security Events connector via Azure Monitor Agent.. Option C is correct because Windows and Linux VMs can be connected to Sentinel via the Azure Monitor Agent to stream security events. Option A is wrong because the connector for Azure Activity logs captures management plane events, not OS-level sign-in attempts. Option B is wrong because the Office 365 connector is for Microsoft 365 logs. Option D is wrong because the Common Event Format connector is for on-premises appliances, not Azure VMs.

Answer

Use the Office 365 connector to collect sign-in logs.

Answer

Use the Common Event Format connector to forward syslog.

Answer

Use the Azure Activity connector to collect sign-in logs.

Question 5

A security team uses Microsoft Defender for Cloud's regulatory compliance dashboard to track compliance with PCI DSS. They notice that some controls are marked as 'N/A' even though they have relevant resources. What is the most likely reason?

Accepted Answer

The resources are in a subscription that is not included in the scope of the compliance standard.. Option A is correct because the regulatory compliance dashboard by default only assesses resources that are in scope for the selected standard. If a subscription or resource group is not included in the scope, controls will show as 'N/A'. Option B is wrong because the dashboard only assesses resources, not manual claims. Option C is wrong because the dashboard uses built-in assessments; it does not require custom assessments. Option D is wrong because the dashboard is available even without a compliance manager license.

Answer

The resources do not have the required custom assessment.

Answer

The compliance dashboard requires a Microsoft Purview Compliance Manager license.

Answer

The resources have not been manually claimed as compliant.

Question 6

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory. Which two data connectors are necessary to collect sign-in logs and audit logs?

Accepted Answer

Azure Active Directory Sign-in logs and Azure Active Directory Audit logs. Option A is correct because Azure Active Directory logs require two connectors: one for Sign-in logs and one for Audit logs. Option B is wrong because the Office 365 connector does not include Azure AD logs. Option C is wrong because the Azure Activity connector is for Azure subscription management logs. Option D is wrong because the Security Events connector is for VMs.

Answer

Azure Activity and Azure Active Directory Audit logs

Answer

Office 365 and Azure Active Directory Sign-in logs

Answer

Security Events and Azure Active Directory Sign-in logs

Question 7

An organization uses Microsoft Defender for Cloud to protect Azure SQL databases. They want to receive alerts when a SQL database is accessed from a suspicious location. What should they enable?

Accepted Answer

Enable Microsoft Defender for Cloud for Azure SQL databases. Option D is correct because Microsoft Defender for Cloud for Azure SQL databases includes threat detection that alerts on anomalous access patterns, including suspicious locations. Option A is wrong because Advanced Threat Protection is the feature name, but it is enabled under Microsoft Defender for Cloud. Option B is wrong because Azure SQL Database auditing logs activity but does not generate alerts. Option C is wrong because Azure Firewall logs network traffic but does not generate SQL-specific alerts.

Answer

Enable Azure Firewall on the SQL server

Answer

Enable Azure SQL Database Advanced Threat Protection

Answer

Enable Azure SQL Database Auditing

Question 8

Your company uses Microsoft Sentinel to correlate data from multiple sources. You need to create an analytics rule that triggers an incident when a user signs in from an unfamiliar location and then performs a high-risk action in Azure. What is the best approach?

Accepted Answer

Create a Fusion analytics rule. Option A is correct because the best approach is to create a fusion rule, which uses machine learning to correlate multiple signals like unfamiliar sign-in and Azure activity. Option B is wrong because scheduled query rules require writing KQL and can correlate but fusion is simpler for this scenario. Option C is wrong because NRT rules are for near-real-time single events. Option D is wrong because anomaly rules detect outliers but not multi-step correlation.

Answer

Run a custom anomaly detection job

Answer

Create a Scheduled analytics rule with a KQL query

Answer

Create a Near-Real-Time (NRT) analytics rule

Question 9

A security analyst needs to view all incidents generated by Microsoft Defender for Cloud across multiple subscriptions in a single pane of glass. What should they use?

Accepted Answer

Microsoft Defender for Cloud. Option B is correct because Microsoft Defender for Cloud provides a unified dashboard that aggregates security alerts and incidents from all subscriptions in the tenant. Option A is wrong because Azure Security Center has been replaced by Defender for Cloud. Option C is wrong because Azure Monitor alerts are separate from Defender for Cloud incidents. Option D is wrong because Microsoft Sentinel can ingest Defender for Cloud alerts but is not required for a unified view.

Answer

Azure Monitor

Answer

Azure Security Center

Answer

Microsoft Sentinel

Question 10

You need to ensure that Microsoft Sentinel can detect threats across your Azure environment, including virtual machines, network traffic, and user activities. Which TWO data sources should you connect?

Accepted Answer

Windows Security Events via AMA. Option A and Option B are correct because Azure Activity logs provide management plane activities, and Windows Security Events provide OS-level events from VMs. Option C is wrong because Azure DNS logs are not a standard Sentinel connector. Option D is wrong because Azure Firewall logs are for specific firewall traffic, not broad network traffic. Option E is wrong because Office 365 logs are for Microsoft 365, not Azure VMs.

Answer

Azure DNS

Answer

Office 365

Answer

Azure Firewall

Question 11

A company uses Microsoft Defender for Cloud's workload protection for Azure Storage. They want to receive alerts when there is suspicious access to blob storage. Which TWO features should they enable?

Accepted Answer

Microsoft Defender for Cloud for Storage. Option B and Option C are correct because Microsoft Defender for Cloud for Storage includes threat detection that alerts on suspicious access patterns, and enabling logging to the Log Analytics workspace provides detailed data for analysis. Option A is wrong because Azure Storage Firewall restricts access but does not generate alerts. Option D is wrong because Azure Storage Encryption protects data at rest, not access monitoring. Option E is wrong because Azure Defender is the old name; the correct name is Microsoft Defender for Cloud.

Answer

Azure Storage Firewall

Answer

Azure Defender for Storage

Answer

Azure Storage Encryption

Question 12

You are deploying Microsoft Sentinel in a new Azure environment. Which THREE resources are required to deploy a Sentinel workspace?

Accepted Answer

Contributor permissions on the resource group. Option A, Option B, and Option D are correct because Sentinel requires a Log Analytics workspace, a Contributor role on the resource group to deploy resources, and the Microsoft.OperationsManagement resource provider to be registered. Option C is wrong because the Azure Sentinel resource provider is not required; the OperationsManagement provider is needed. Option E is wrong because Microsoft Defender for Cloud is not a prerequisite.

Answer

Microsoft Defender for Cloud enabled

Answer

The Microsoft.Sentinel resource provider registered

Question 13

Refer to the exhibit. You are assigning this Azure Policy to a management group. The goal is to automatically deploy the Azure Monitor Agent to Windows VMs that do not have it. However, after assignment, you notice that the policy is not deploying the agent. What is the most likely reason?

Accepted Answer

The policy definition is incomplete; it lacks the deployment specification for the DeployIfNotExists effect.. Option D is correct because the policy rule only checks if the resource type is a virtual machine, but it does not check whether the agent is already installed or not; it will attempt to deploy on every VM, but the deployment action is missing from the policy definition. The policy snippet only shows the condition and effect, but the actual deployment task (the 'deployment' property) is not included. Option A is wrong because the policy is built-in and includes all details. Option B is wrong because the policy mode 'Indexed' is correct for VMs. Option C is wrong because the effect 'DeployIfNotExists' is allowed.

Answer

The effect parameter is set to 'AuditIfNotExists'.

Answer

The policy mode should be 'All' instead of 'Indexed'.

Answer

The policy is a built-in policy and cannot be assigned.

Question 14

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

To list the top 10 most frequent alert names along with their severity over the last 7 days.. Option A is correct because the query summarizes the count of alerts by AlertName and AlertSeverity and returns the top 10 by count descending. Option B is wrong because the query does not filter by severity. Option C is wrong because it returns top 10, not all. Option D is wrong because it does not filter by time beyond the initial 7 days.

Answer

To list all alerts with severity 'High' in the last 7 days.

Answer

To list all alerts generated in the last 7 days.

Answer

To list the count of alerts per severity for the last 7 days.

Question 15

Refer to the exhibit. This is an excerpt from an Azure Policy assignment. What is the effect of the 'notScopes' property?

Accepted Answer

The policy will apply to all resources in RG-Prod except the VM-Sensitive virtual machine.. Option C is correct because 'notScopes' excludes specific sub-scopes from the policy assignment. In this case, the policy applies to all resources in 'RG-Prod' except the VM named 'VM-Sensitive'. Option A is wrong because 'notScopes' do not add resources. Option B is wrong because it does not remove the entire resource group. Option D is wrong because it does not affect subscription-level exclusions.

Answer

The policy will apply only to the VM-Sensitive virtual machine.

Answer

The policy will apply to all resources in RG-Prod except the entire resource group.

Answer

The policy will apply to the subscription but not to RG-Prod.

Question 16

Your organization uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions have the 'Auto-provisioning' extension enabled for Log Analytics agent on new VMs. What should you configure?

Accepted Answer

Enable 'Auto-provisioning' in Defender for Cloud's environment settings.. Option A is correct because Auto-provisioning settings in Defender for Cloud allow you to automatically deploy the Log Analytics agent to new VMs. Option B is wrong because Azure Policy can be used but is not the direct setting for auto-provisioning in Defender for Cloud. Option C is wrong because Azure Automation State Configuration is not used for this purpose. Option D is wrong because Microsoft Sentinel is a SIEM, not a configuration tool for agent deployment.

Answer

Configure Azure Automation State Configuration to push the agent.

Answer

Set up data connectors in Microsoft Sentinel.

Answer

Create an Azure Policy assignment to deploy the Log Analytics agent.

Question 17

Your company has a hybrid environment with on-premises servers and Azure VMs. All resources are onboarded to Microsoft Defender for Cloud. You need to receive alerts when a critical vulnerability is detected on any server. The security team wants to minimize false positives. What should you configure?

Accepted Answer

Enable vulnerability assessment for servers via the integrated VA solution.. Option B is correct because vulnerability assessment (VA) solutions, like the integrated Qualys or Microsoft Defender Vulnerability Management, scan for known vulnerabilities and generate alerts. Option A is wrong because adaptive application controls are for whitelisting applications, not vulnerability detection. Option C is wrong because just-in-time (JIT) VM access is for managing RDP/SSH access. Option D is wrong because file integrity monitoring (FIM) monitors file changes, not vulnerabilities.

Answer

Configure just-in-time VM access to reduce attack surface.

Answer

Enable adaptive application controls to detect unapproved software.

Answer

Enable file integrity monitoring on critical files.

Question 18

A security analyst reports that Microsoft Sentinel is not receiving Windows Security Events from Azure VMs that have the Log Analytics agent installed. The agent shows as connected, and other data sources (e.g., performance counters) are flowing. What is the most likely cause?

Accepted Answer

The Windows Security Events connector is not configured to collect the required event IDs.. Option D is correct because the Windows Security Events connector in Sentinel requires specific event IDs to be collected; if the data collection rule or agent configuration does not include the required event IDs, the events won't be sent. Option A is wrong because the Log Analytics workspace key or certificate issue would affect all data, not just security events. Option B is wrong because if the agent is connected, network connectivity is fine. Option C is wrong because the Microsoft Sentinel solution is installed at the workspace level, not per VM.

Answer

The Microsoft Sentinel solution is not installed on the VM.

Answer

The Azure VM has a network security group blocking port 443.

Answer

The Log Analytics workspace key is incorrect.

Question 19

Your organization uses Microsoft Defender for Cloud to assess regulatory compliance. You need to ensure that the compliance dashboard reflects the latest standards and that custom assessments are included. What should you do?

Accepted Answer

Add a custom regulatory compliance standard in Defender for Cloud.. Option C is correct because the regulatory compliance dashboard in Defender for Cloud allows you to add custom initiatives and standards, including custom assessments. Option A is wrong because Azure Blueprints are deprecated and not the correct tool. Option B is wrong because Azure Policy alone does not integrate with the compliance dashboard. Option D is wrong because Microsoft Purview compliance portal is for data governance, not cloud security compliance assessment.

Answer

Configure Microsoft Purview compliance portal to include Azure subscriptions.

Answer

Use Azure Policy to apply custom definitions and assign to management groups.

Answer

Create an Azure Blueprint with custom policies.

Question 20

You are investigating a security incident in Microsoft Sentinel. A KQL query returns results indicating that a user logged in from an IP address that is not in the organization's approved list. The user's account has been compromised. You need to automatically disable the user account in Microsoft Entra ID when such an alert is triggered. What should you configure?

Accepted Answer

Create a playbook in Microsoft Sentinel with a Logic Apps connector to Microsoft Entra ID.. Option D is correct because Microsoft Sentinel can use automation rules with playbooks (based on Azure Logic Apps) to trigger actions like disabling a user in Microsoft Entra ID. Option A is wrong because Azure Policy cannot disable user accounts. Option B is wrong because Microsoft Defender for Cloud does not manage Entra ID user accounts. Option C is wrong because Power Automate is not natively integrated with Sentinel for this purpose.

Answer

Configure an Azure Policy that disables the user account.

Answer

Use Microsoft Defender for Cloud to automatically disable the account.

Answer

Create a Power Automate flow triggered by the Sentinel alert.