AZ-500 Manage identity and access Practice Test 11 — 15 Questions

Question 1

A security team wants to visualize MITRE ATT&CK coverage for Microsoft Sentinel analytics rules. Which Sentinel experience should they use?

Accepted Answer

MITRE ATT&CK coverage in analytics/content hub views. The MITRE ATT&CK coverage view in the Microsoft Sentinel analytics/content hub provides a direct mapping between configured analytics rules and specific MITRE ATT&CK techniques. This allows security teams to visually identify gaps in detection coverage by seeing which techniques are covered by active rules and which are not, enabling targeted rule deployment.

Answer

Hunting bookmarks

Answer

Watchlists

Answer

Data collection endpoints

Question 2

A KQL hunting query joins SecurityIncident with SecurityAlert but returns duplicate rows for incidents with multiple alerts. What KQL approach best preserves one row per incident while summarizing alert details?

Accepted Answer

Use summarize make_set() or arg_max() grouped by IncidentNumber. `summarize make_set()` or `arg_max()` grouped by `IncidentNumber` collapses multiple alert rows into a single incident row while preserving alert details in an array or the most recent alert. This directly addresses the duplicate rows caused by a one-to-many join between SecurityIncident and SecurityAlert, ensuring one row per incident without data loss.

Answer

Use order by TimeGenerated desc only

Answer

Replace join with union

Answer

Use take 1 before the join

Question 3

A DevOps team wants Defender for Cloud to identify secrets exposed in GitHub repositories. What should be configured?

Accepted Answer

Defender for Cloud DevOps Security connector. Defender for Cloud's DevOps Security connector integrates with GitHub to scan repositories for exposed secrets (e.g., API keys, tokens) using Microsoft's secret scanning engine. This connector enables Defender for Cloud to monitor commits and pull requests, alerting on secrets detected in code. It is the correct solution because it directly addresses the requirement to identify secrets in GitHub repositories within the Defender for Cloud ecosystem.

Answer

Azure Bastion native client

Answer

Sentinel Syslog connector

Answer

Azure Storage lifecycle management

Question 4

A team wants Sentinel to ingest firewall logs from an appliance that emits Common Event Format over Syslog. Which connector pattern is most appropriate?

Accepted Answer

CEF connector using a Linux log forwarder or AMA-supported collection path. The Common Event Format (CEF) over Syslog is a standard logging format used by many security appliances. Sentinel's CEF connector is specifically designed to ingest these logs, typically using a Linux log forwarder (rsyslog or syslog-ng) or the Azure Monitor Agent (AMA) with a Data Collection Rule to parse and forward the CEF messages to the Log Analytics workspace.

Answer

Azure Activity connector

Answer

Microsoft Entra ID Protection connector

Answer

Office 365 connector

Question 5

A Defender for Cloud secure score recommendation says storage accounts allow public blob access. What remediation best addresses the root issue?

Accepted Answer

Disable public blob access at the storage account level and review container ACLs. The secure score recommendation indicates that storage accounts allow public blob access, which is a security risk. The root cause is that anonymous access is enabled at the storage account level, and individual container ACLs may also permit public access. Disabling public blob access at the storage account level (via the 'AllowBlobPublicAccess' property) immediately blocks all anonymous requests, and reviewing container ACLs ensures no residual permissions exist. This directly addresses the vulnerability by enforcing a deny-by-default posture.

Answer

Enable storage account static website hosting

Answer

Increase Log Analytics retention

Answer

Create an Azure Front Door profile

Question 6

An organization wants to detect when a privileged Azure role assignment is created outside the approved change window. Which log source should a Sentinel rule query?

Accepted Answer

AzureActivity. AzureActivity logs capture all control-plane operations on Azure resources, including role assignment creations (e.g., 'Microsoft.Authorization/roleAssignments/write'). By querying AzureActivity in a Sentinel rule, you can detect when a privileged role assignment is made outside an approved change window. Heartbeat, Perf, and StorageBlobLogs do not record Azure RBAC changes.

Answer

Heartbeat

Answer

Perf

Answer

StorageBlobLogs

Question 7

A company wants Defender for Cloud to recommend fixes for container image vulnerabilities stored in Azure Container Registry. Which capability is most relevant?

Accepted Answer

Container vulnerability assessment in Defender for Containers. Defender for Containers includes a container vulnerability assessment capability that scans container images stored in Azure Container Registry (ACR) for known vulnerabilities. This assessment integrates with Defender for Cloud to provide actionable recommendations for fixing identified vulnerabilities, directly addressing the company's requirement.

Answer

Azure SQL auditing

Answer

Microsoft Entra access reviews

Answer

Application Gateway rewrite rules

Question 8

A Sentinel analyst needs to preserve investigation notes, related entities, and ownership while escalating a case to another analyst. Which object should be updated?

Accepted Answer

The Sentinel incident. The Sentinel incident object is the correct entity to update because it serves as the central container for investigation notes, related entities, and ownership assignments during case escalation. Updating the incident preserves the full investigation context—including comments, tags, and assigned owner—ensuring seamless handoff between analysts without data loss.

Answer

A watchlist item

Answer

A workbook parameter

Answer

A data connector

Question 9

A security engineer needs to collect custom application logs from Azure VMs using Azure Monitor Agent for Sentinel analysis. Which two components are required?

Accepted Answer

A Data Collection Rule that defines the custom log collection. Option A is correct because a Data Collection Rule (DCR) is the Azure Monitor Agent mechanism that defines what data to collect, including custom logs via a custom text or JSON log definition, and where to send it (e.g., a Log Analytics workspace used by Microsoft Sentinel). Option C is correct because a DCR must be associated with the target machines (through a DCR association on the VM or via Azure Policy/monitoring insights) for the Azure Monitor Agent to actually apply that collection configuration to those VMs. Option B is incorrect because a storage account configured for static website hosting is unrelated to log ingestion by Azure Monitor Agent; custom logs are sent to a Log Analytics workspace, not served as web content. Option D is incorrect because Conditional Access policies govern user/identity sign-in access to resources and play no role in agent-based log collection from VMs.

Answer

A storage account configured for static website hosting

Answer

A Conditional Access policy requiring MFA

Question 10

A Microsoft Sentinel rule should run with minimal delay against supported data sources and produce alerts close to event time. Which rule type should be considered?

Accepted Answer

Near-real-time analytics rule. Near-real-time (NRT) analytics rules in Microsoft Sentinel are designed to run at 1-minute intervals, providing the minimal delay for alert generation against supported data sources. This rule type queries data with low latency, ensuring alerts are produced close to the event time, which is critical for timely threat detection.

Answer

Fusion rule

Answer

Workbook query

Answer

Threat intelligence indicator import

Question 11

A Defender for Cloud recommendation requires enabling private endpoints for a storage account. Which security risk is primarily reduced?

Accepted Answer

Public internet exposure of the storage service endpoint. Enabling private endpoints for a storage account connects it to an Azure Virtual Network over a private IP address, eliminating access from the public internet. This directly reduces the risk of public internet exposure of the storage service endpoint (Option B). The primary risk addressed is network-level exposure, not identity-related risks like unauthorized changes to Microsoft Entra ID users (Option C). While private endpoints can contribute to a defense-in-depth strategy, the most immediate and primary risk reduction is the removal of public network accessibility.

Answer

VM disk fragmentation

Answer

Unauthorized changes to Azure AD users

Answer

Excessive Log Analytics ingestion

Question 12

A Sentinel watchlist contains high-value administrator accounts. Which KQL pattern best uses it in a detection rule?

Accepted Answer

Load the watchlist with _GetWatchlist() and join or filter SigninLogs by the account identifier. The `_GetWatchlist()` function in KQL allows you to dynamically load a Sentinel watchlist into a query. By joining or filtering `SigninLogs` against the watchlist's account identifier field, you can create a detection rule that triggers only when a high-value administrator account (defined in the watchlist) performs a sign-in, enabling precise, automated alerting without manual intervention.

Answer

Export the watchlist to CSV and manually compare it after alerts fire

Answer

Use the watchlist as a replacement for the SigninLogs table

Answer

Attach the watchlist to a workbook without changing the detection query

Question 13

A company wants to identify excessive permissions across Azure, AWS, and GCP identities. Which Microsoft security capability is designed for cloud infrastructure entitlement management?

Accepted Answer

Microsoft Entra Permissions Management. Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility into permissions assigned to identities across multi-cloud environments (Azure, AWS, GCP). It helps detect and remediate excessive, unused, or risky permissions by analyzing identity activity and entitlement data, enabling least-privilege access control.

Answer

Azure Monitor metrics

Answer

Microsoft Purview eDiscovery

Answer

Azure Front Door WAF

Question 14

An analyst investigates a Defender for Cloud alert for suspicious process execution on a VM. Which next step best preserves evidence while enabling deeper endpoint investigation?

Accepted Answer

Pivot to Microsoft Defender for Endpoint device timeline and isolate the device if containment is required. Pivoting to the Microsoft Defender for Endpoint device timeline allows the analyst to investigate the suspicious process execution in a forensically sound manner without disrupting the live environment. Isolating the device from the network, if needed, contains the threat while preserving volatile evidence such as running processes, memory, and registry state. This approach aligns with incident response best practices and leverages Defender for Endpoint's deep endpoint visibility.

Answer

Delete the VM immediately to stop the process

Answer

Disable all analytics rules in Sentinel

Answer

Rotate every subscription key before reviewing the process tree

Question 15

A team wants Sentinel incidents to automatically assign to the Tier 2 queue when severity is High and the product name is Microsoft Defender for Endpoint. What should they configure?

Accepted Answer

An automation rule that updates owner/status based on conditions. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners or queues based on conditions like severity and product name. By configuring an automation rule with a condition that triggers when severity equals 'High' and the product name is 'Microsoft Defender for Endpoint', you can set the incident owner to a specific user or group (e.g., Tier 2 queue) and optionally update the status. This directly meets the requirement without manual intervention.

Answer

A workbook with a dropdown filter

Answer

A watchlist containing Tier 2 users only

Answer

A data retention policy