AZ-500 Manage identity and access Practice Test 4 — 15 Questions

Question 1

A security operations team uses Microsoft Sentinel for security monitoring. They want to automatically create an incident and send an email to the on-call security engineer when a specific event occurs in Azure Activity Log, such as someone disabling a key vault firewall. Which automation feature should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automation rules. Automation rules are the correct feature because they can automatically create an incident when a specific alert is generated and can invoke a playbook to send an email to the on-call engineer. Playbooks alone cannot create incidents; they only execute workflows after an alert/incident already exists.

Answer

Playbooks (Azure Logic Apps)

Answer

Scheduled analytics rules

Answer

Livestream

Question 2

A security team uses Microsoft Defender for Cloud. They have enabled the integrated vulnerability assessment (VA) solution on their Azure virtual machines. They want to receive alerts when a VM has a vulnerability rated 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated Qualys-based vulnerability assessment (VA) solution that continuously scans Azure VMs for vulnerabilities and provides security alerts when critical vulnerabilities are found. Plan 1 only offers basic threat detection and does not include the integrated VA scanner or the ability to generate alerts based on VA findings.

Answer

Defender for Servers Plan 1

Answer

Defender for Cloud Apps

Answer

Defender for Storage

Question 3

A security operations team uses Microsoft Sentinel for security monitoring. They want to automatically create an incident and send an email to the on-call security engineer when a specific event occurs in Azure Activity Log, such as someone disabling a key vault firewall. Which automation feature should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail connector. The AWS CloudTrail connector is the correct data connector for ingesting AWS CloudTrail logs into Microsoft Sentinel. It requires configuring an S3 bucket in AWS to receive CloudTrail logs and then connecting that bucket to Sentinel via the connector, enabling the detection of suspicious activities such as unauthorized API calls or privilege escalations in the AWS environment.

Answer

Azure Activity log connector

Answer

Syslog connector

Answer

Common Event Format (CEF) connector

Question 4

A security analyst is using Microsoft Sentinel to detect multi-stage attacks. They want to create an analytics rule that correlates a user sign-in from an unusual location with a subsequent data exfiltration attempt from Azure Blob Storage within one hour. Which type of analytics rule should they use?

Accepted Answer

Scheduled query rule with entity mapping.. A scheduled query rule with entity mapping is correct because it allows the security analyst to write a KQL query that correlates two distinct events—a sign-in from an unusual location and a subsequent data exfiltration from Azure Blob Storage—within a defined time window (one hour). Entity mapping enables the rule to link these events by common entities (e.g., user account or IP address), which is essential for detecting multi-stage attacks. This rule type runs on a schedule, making it ideal for time-bound correlation queries.

Answer

Fusion rule.

Answer

Microsoft Security incident rule.

Answer

Anomaly rule.

Question 5

A company uses Microsoft Defender for Cloud to protect their Azure virtual machines. They have enabled the integrated vulnerability assessment (VA) solution on all VMs. The security team wants to receive an alert when a VM is found to have a vulnerability rated as 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated vulnerability assessment (VA) solution powered by Qualys, which provides continuous scanning and alerts for critical vulnerabilities. Plan 1 only offers basic threat detection and does not include the VA solution or the ability to generate alerts based on vulnerability severity ratings.

Answer

Defender for Servers Plan 1

Answer

Defender for SQL

Answer

Defender for App Service

Question 6

An organization is required to comply with the Health Insurance Portability and Accountability Act (HIPAA). They use Microsoft Defender for Cloud to manage their Azure security posture. Which feature in Defender for Cloud should they use to view their current compliance status against HIPAA controls?

Accepted Answer

Regulatory compliance dashboard.. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of your compliance posture against various standards, including HIPAA. It continuously assesses your Azure environment against HIPAA controls and displays the current compliance status, enabling you to track and improve adherence to regulatory requirements.

Answer

Security posture dashboard.

Answer

Recommendations dashboard.

Answer

Inventory dashboard.

Question 7

A security team uses Microsoft Sentinel. They have created a playbook in Azure Logic Apps that automatically isolates a compromised VM by modifying a network security group. They want the playbook to run automatically whenever an incident of type 'VM Isolation' is created. Which Microsoft Sentinel feature should they use to trigger the playbook automatically?

Accepted Answer

Automation rules.. Automation rules in Microsoft Sentinel are designed to trigger automated responses, such as running a playbook, when an incident is created or updated. In this scenario, the rule can be configured to match incidents of type 'VM Isolation' and automatically execute the Logic Apps playbook to isolate the compromised VM. This is the correct feature for incident-triggered automation without requiring a separate analytics rule.

Answer

Scheduled analytics rules.

Answer

Fusion rules.

Answer

Workbooks.

Question 8

A security analyst uses Microsoft Defender for Cloud. They need to automatically apply a specific remediation action (e.g., enable audit logging) to a set of Azure SQL servers that are found to be non-compliant with a security policy. Which Defender for Cloud feature should they use?

Accepted Answer

Workflow automation. Workflow automation in Microsoft Defender for Cloud allows you to trigger Logic Apps based on security alerts or policy compliance changes. By configuring a workflow automation rule that triggers on the 'Non-compliant resource' condition for the specific Azure SQL servers, you can automatically invoke a remediation action, such as enabling audit logging, without manual intervention.

Answer

Continuous export

Answer

Alert suppression rules

Answer

Regulatory compliance dashboard

Question 9

A company uses Microsoft Defender for Cloud. They want to automatically apply a security recommendation (such as enabling encryption on storage accounts) to all existing resources that are found to be non-compliant without manual intervention. Which Defender for Cloud feature should they configure?

Accepted Answer

Workflow automation. Workflow automation in Microsoft Defender for Cloud allows you to trigger automated actions (e.g., Azure Logic Apps) based on security recommendations or regulatory compliance changes. By configuring a workflow automation rule that triggers on the 'recommendation' event for a specific recommendation (like 'Storage accounts should use customer-managed key for encryption'), you can automatically remediate non-compliant resources without manual intervention, for example by invoking a Logic App that enables encryption on the storage account.

Answer

Continuous export

Answer

Email notifications

Answer

Security policies

Question 10

A security team uses Microsoft Defender for Cloud to improve their security posture across multiple subscriptions. They want to quickly identify which security recommendations have the highest potential to improve their security score if remediated. Which dashboard or feature should they use?

Accepted Answer

Secure Score dashboard. The Secure Score dashboard in Microsoft Defender for Cloud is specifically designed to show security recommendations ranked by their potential impact on the overall security score. Each recommendation includes a 'score impact' value, allowing the team to prioritize remediation actions that will most effectively improve their security posture across multiple subscriptions.

Answer

Regulatory Compliance dashboard

Answer

Security Alerts dashboard

Answer

Inventory dashboard

Question 11

A security analyst uses Microsoft Sentinel. They want to create a rule that triggers an incident when a user is added to a highly privileged Azure AD role (e.g., Global Administrator). The data source is Azure AD audit logs. Which type of analytics rule should they create?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because Azure AD audit logs are ingested into Log Analytics and scheduled queries run on a defined interval (e.g., every 5 minutes) to detect patterns like role assignments. This rule type allows you to write a KQL query against the AuditLogs table to identify when a user is added to a highly privileged role, then map the results to an incident. While NRT rules can also query AuditLogs and provide lower latency, they are intended for high-frequency, time-sensitive detections and may have limitations on query complexity (e.g., no joins). For this scenario, a scheduled query is the standard and recommended approach.

Answer

Near-real-time (NRT) rule

Answer

Fusion rule

Answer

Microsoft Security incident creation rule

Question 12

Security analysts in your company use Microsoft Sentinel to manage incidents. They want to automatically assign any incident with a severity of 'High' or 'Critical' to the senior analyst on duty. Which Microsoft Sentinel feature should they configure to accomplish this?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific users or groups based on conditions such as severity. By creating an automation rule that triggers when an incident is created with a severity of 'High' or 'Critical', you can set the owner to the senior analyst on duty, fulfilling the requirement without manual intervention.

Answer

Playbooks

Answer

Workbooks

Answer

Analytics rules

Question 13

A security team uses Microsoft Sentinel. They want to create a custom analytic rule that triggers an incident when more than 10 failed Azure Active Directory sign-ins occur from the same source IP address within any 5-minute window. Which type of rule should they use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the appropriate choice because it allows you to define a KQL query that counts failed Azure AD sign-ins grouped by source IP address within a 5-minute window, and then triggers an incident when the count exceeds 10. Scheduled rules give you full control over the aggregation window, lookback period, and threshold logic. NRT rules, while capable of using KQL aggregation in their lookback period, are designed for low-latency, single-event scenarios and are not the standard choice for this pattern-based threshold alert.

Answer

Near-Real-Time (NRT) rule

Answer

Fusion rule

Answer

Anomaly rule

Question 14

A security analyst uses Microsoft Defender for Cloud. They need to assess their Azure environment's compliance against the Payment Card Industry Data Security Standard (PCI DSS). Which dashboard in Defender for Cloud should they use to view the compliance status?

Accepted Answer

Regulatory Compliance. The Regulatory Compliance dashboard in Microsoft Defender for Cloud provides a pre-built assessment of your Azure environment against specific compliance standards, including PCI DSS. It maps your security controls to the requirements of the standard and shows a compliance score based on the results of continuous assessments. This is the correct tool for viewing compliance status against PCI DSS.

Answer

Secure Score

Answer

Security Alerts

Answer

Workbooks

Question 15

A company needs to demonstrate compliance with the Payment Card Industry Data Security Standard (PCI DSS) for their Azure workloads. They use Microsoft Defender for Cloud for security management. Which feature should they use to view their current compliance status against PCI DSS controls and track progress over time?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of compliance posture against standards like PCI DSS. It maps Azure resource configurations to specific PCI DSS controls, shows pass/fail status per control, and tracks compliance score over time, enabling continuous monitoring and evidence collection for auditors.

Answer

Security policy

Answer

Recommendations

Answer

Security incidents