AZ-500 Manage identity and access Practice Test 2 — 15 Questions

Question 1

A security team uses Microsoft Defender for Cloud. They have enabled the integrated vulnerability assessment (VA) solution on their Azure virtual machines. They want to receive alerts when a VM has a vulnerability rated 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated Qualys-based vulnerability assessment (VA) solution that continuously scans Azure VMs for vulnerabilities and provides security alerts when critical vulnerabilities are found. Plan 1 only offers basic threat detection and does not include the integrated VA scanner or the ability to generate alerts based on VA findings.

Answer

Defender for Servers Plan 1

Answer

Defender for Cloud Apps

Answer

Defender for Storage

Question 2

A company uses Microsoft Defender for Cloud to protect their Azure virtual machines. They have enabled the integrated vulnerability assessment (VA) solution on all VMs. The security team wants to receive an alert when a VM is found to have a vulnerability rated as 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated vulnerability assessment (VA) solution powered by Qualys, which provides continuous scanning and alerts for critical vulnerabilities. Plan 1 only offers basic threat detection and does not include the VA solution or the ability to generate alerts based on vulnerability severity ratings.

Answer

Defender for Servers Plan 1

Answer

Defender for SQL

Answer

Defender for App Service

Question 3

A security analyst uses Microsoft Defender for Cloud. They need to automatically apply a specific remediation action (e.g., enable audit logging) to a set of Azure SQL servers that are found to be non-compliant with a security policy. Which Defender for Cloud feature should they use?

Accepted Answer

Workflow automation. Workflow automation in Microsoft Defender for Cloud allows you to trigger Logic Apps based on security alerts or policy compliance changes. By configuring a workflow automation rule that triggers on the 'Non-compliant resource' condition for the specific Azure SQL servers, you can automatically invoke a remediation action, such as enabling audit logging, without manual intervention.

Answer

Continuous export

Answer

Alert suppression rules

Answer

Regulatory compliance dashboard

Question 4

A company uses Microsoft Defender for Cloud. They want to automatically apply a security recommendation (such as enabling encryption on storage accounts) to all existing resources that are found to be non-compliant without manual intervention. Which Defender for Cloud feature should they configure?

Accepted Answer

Workflow automation. Workflow automation in Microsoft Defender for Cloud allows you to trigger automated actions (e.g., Azure Logic Apps) based on security recommendations or regulatory compliance changes. By configuring a workflow automation rule that triggers on the 'recommendation' event for a specific recommendation (like 'Storage accounts should use customer-managed key for encryption'), you can automatically remediate non-compliant resources without manual intervention, for example by invoking a Logic App that enables encryption on the storage account.

Answer

Continuous export

Answer

Email notifications

Answer

Security policies

Question 5

A security analyst uses Microsoft Sentinel. They want to create a rule that triggers an incident when a user is added to a highly privileged Azure AD role (e.g., Global Administrator). The data source is Azure AD audit logs. Which type of analytics rule should they create?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because Microsoft Entra ID audit logs are ingested into Log Analytics and scheduled queries run on a defined interval (e.g., every 5 minutes) to detect patterns like role assignments. This rule type allows you to write a KQL query against the AuditLogs table to identify when a user is added to a highly privileged role, then map the results to an incident. While NRT rules can also query AuditLogs and provide lower latency, they are intended for high-frequency, time-sensitive detections and may have limitations on query complexity (e.g., no joins). For this scenario, a scheduled query is the standard and recommended approach.

Answer

Near-real-time (NRT) rule

Answer

Fusion rule

Answer

Microsoft Security incident creation rule

Question 6

A security team uses Microsoft Sentinel. They want to create a custom analytic rule that triggers an incident when more than 10 failed Azure Active Directory sign-ins occur from the same source IP address within any 5-minute window. Which type of rule should they use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the appropriate choice because it allows you to define a KQL query that counts failed Microsoft Entra ID sign-ins grouped by source IP address within a 5-minute window, and then triggers an incident when the count exceeds 10. Scheduled rules give you full control over the aggregation window, lookback period, and threshold logic. NRT rules, while capable of using KQL aggregation in their lookback period, are designed for low-latency, single-event scenarios and are not the standard choice for this pattern-based threshold alert.

Answer

Near-Real-Time (NRT) rule

Answer

Fusion rule

Answer

Anomaly rule

Question 7

A security team uses Microsoft Defender for Cloud. They have enabled the integrated vulnerability assessment (VA) solution on their Azure virtual machines. They want to receive alerts when a VM has a vulnerability rated 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Auto-provisioning settings. Auto-provisioning settings in Microsoft Defender for Cloud automatically deploy the Log Analytics agent to all supported Azure VMs and new ones as they are created. This ensures that security events are collected without manual intervention, directly addressing the requirement for automatic installation on new VMs.

Answer

Automation rules

Answer

Security contacts

Answer

Workflow automation

Question 8

A security team uses Microsoft Defender for Cloud. They have enabled the integrated vulnerability assessment (VA) solution on their Azure virtual machines. They want to receive alerts when a VM has a vulnerability rated 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy integration. Azure Policy integration is the correct feature because it allows you to create and assign policies that audit or enforce configurations across Azure resources. By using a built-in policy like 'Vulnerability assessment should be enabled on SQL servers', you can automatically remediate non-compliant resources, including future ones, at the subscription scope. This ensures that all existing and new Azure SQL Database servers have the vulnerability assessment solution enabled without manual intervention.

Answer

Workflow automation

Answer

Continuous export

Answer

Security policies (initiatives)

Question 9

A security team uses Microsoft Sentinel. They want to create a playbook that automatically adds a tag 'isolated' to any Azure virtual machine that triggers a high-severity security alert. How should they configure the automation?

Accepted Answer

Create a playbook in Logic Apps and attach it to the alert as an automation rule. Microsoft Sentinel playbooks are built on Azure Logic Apps and can be triggered by automation rules. An automation rule is configured to run when a high-severity alert is generated, and it invokes the playbook, which then uses the Azure Resource Manager connector to add the 'isolated' tag to the triggering virtual machine. This is the native, supported method for automated incident response in Sentinel.

Answer

Create an analytics rule with an automated response

Answer

Use a workbook to trigger the playbook

Answer

Configure a data connector

Question 10

A company uses Microsoft Defender for Cloud. They want to automatically implement a specific security recommendation (e.g., 'Enable encryption for Azure SQL Database') on all existing and future SQL Database instances in a subscription. Which feature should they use?

Accepted Answer

Security policy with a custom initiative.. A custom initiative in a security policy allows you to define a set of security recommendations (e.g., 'Enable encryption for Azure SQL Database') and enforce them via Azure Policy. By assigning this initiative at the subscription scope with a 'DeployIfNotExists' or 'Modify' effect, you can automatically remediate non-compliant resources and ensure that all existing and future SQL Database instances have encryption enabled. This is the correct mechanism for automated, continuous compliance with custom security requirements.

Answer

Regulatory compliance dashboard.

Answer

Workload protection plans.

Answer

Vulnerability assessment.

Question 11

An organization uses Microsoft Defender for Cloud. They want to receive alerts when Azure virtual machines do not have disk encryption enabled. What should they configure to achieve this?

Accepted Answer

A security policy recommendation in Defender for Cloud. Defender for Cloud's security policy recommendations include 'Disk encryption should be applied on virtual machines' as a built-in recommendation. When enabled, Defender for Cloud continuously assesses VMs against this recommendation and generates alerts for non-compliant resources. This is the native mechanism within Defender for Cloud to monitor and alert on missing disk encryption without requiring external tools or custom rules.

Answer

A custom alert rule in Microsoft Sentinel

Answer

A regulatory compliance standard in Defender for Cloud

Answer

An Azure Policy initiative

Question 12

A company uses Microsoft Defender for Cloud. They want to receive alerts when a virtual machine has a vulnerability that is rated 'Critical' by the integrated vulnerability assessment solution. Which Defender for Cloud plan must be enabled?

Accepted Answer

Defender for Servers plan (P2 or P1). The integrated vulnerability assessment solution in Microsoft Defender for Cloud relies on the Qualys or Microsoft Defender Vulnerability Management (MDVM) agent, which is only available with the Defender for Servers plan. The P2 tier includes the full vulnerability assessment capabilities, while P1 provides foundational coverage; both can generate alerts for critical vulnerabilities. Without this plan, the vulnerability assessment engine is not active, so no critical alerts will be produced.

Answer

Defender for Cloud's free foundational CSPM

Answer

Defender for Storage plan

Answer

Defender for SQL plan

Question 13

A company uses Microsoft Defender for Cloud. They want to receive email notifications when a high-severity security alert is generated for any resource in the subscription. Which configuration should they make in Defender for Cloud?

Accepted Answer

Configure the 'Email notifications' setting in Defender for Cloud to send alerts to the required email addresses.. The 'Email notifications' setting in Microsoft Defender for Cloud allows you to directly configure email recipients to receive notifications for high-severity alerts. This built-in feature sends emails to specified addresses whenever a high-severity security alert is triggered for any resource in the subscription, without requiring additional automation or external tools.

Answer

Create a workflow automation in Defender for Cloud that sends an email when a high-severity alert is generated.

Answer

Enable continuous export to stream all security alerts to a Log Analytics workspace and create an alert rule to send email.

Answer

Enable the 'Send email alerts' option in the Azure Monitor activity log alert rule.

Question 14

A Sentinel data connector based on Azure Monitor Agent stops collecting Windows Security Events after migration from the legacy agent. What should the engineer verify first?

Accepted Answer

A Data Collection Rule is associated with the target machines and includes the required event streams. After migrating from the legacy Log Analytics Agent to the Azure Monitor Agent (AMA), data collection is governed by Data Collection Rules (DCRs). If the DCR is not associated with the target machines or does not include the required Windows Security Event data streams (e.g., `Microsoft-Event` or `SecurityEvent`), the Sentinel connector will stop receiving events. This is the most common root cause because AMA relies entirely on DCRs for configuration, unlike the legacy agent which used workspace settings directly.

Answer

The workspace has a saved KQL function named SecurityEvent

Answer

The machines are assigned an Azure Policy initiative for tags

Answer

The analytics rule is configured as near-real-time

Question 15

An enterprise app requests tenant-wide admin consent for Microsoft Graph permissions. Security wants to prevent unreviewed user consent while allowing approved apps. Which two controls help meet this requirement?

Accepted Answer

Configure admin consent workflow. The admin consent workflow allows users to request admin approval for apps they want to consent to, ensuring that no unreviewed user consent is granted while still enabling approved apps. This workflow routes consent requests to designated administrators for review, meeting the security requirement of preventing unreviewed user consent.

Answer

Allow all users to grant consent to any app

Answer

Disable service principals globally