AZ-500 Manage identity and access Practice Test 4 — 15 Questions

Question 1

A company uses Azure AD Privileged Identity Management (PIM) for Azure AD roles. They want to require that users must perform multi-factor authentication (MFA) when activating a role. Which PIM setting should they configure?

Accepted Answer

Require Azure AD Multi-Factor Authentication on activation. To enforce multi-factor authentication during role activation in Azure AD Privileged Identity Management (PIM), you must configure the 'Require Azure AD Multi-Factor Authentication on activation' setting. This ensures that before a user’s role assignment is activated, they must complete an MFA challenge, adding an extra layer of security against unauthorized access.

Answer

Require approval to activate

Answer

Require justification on activation

Answer

Require ticket information on activation

Question 2

A company uses Microsoft Defender for Cloud's Just-In-Time (JIT) VM access to manage RDP connections to a critical jump-box virtual machine. The company has a CI/CD pipeline running on Azure DevOps agent pools that needs to periodically RDP into this VM to deploy software. The agent pool's source IP addresses are dynamic and change frequently. They want the pipeline to automatically request JIT access before each deployment without manual intervention. Which approach should they implement?

Accepted Answer

Use the Azure REST API with a managed identity assigned to the DevOps agent to request JIT access, specifying the agent's current source IP address. Option A is correct because it uses the Azure REST API with a managed identity to dynamically request JIT VM access, specifying the agent's current source IP address. This approach allows the CI/CD pipeline to authenticate without secrets and automatically obtain time-bound RDP access, even though the agent's IP changes frequently. The managed identity provides secure, automated authentication to Azure Resource Manager, enabling the pipeline to call the JIT policy endpoint and grant access for the deployment duration.

Answer

Create a JIT access rule in Defender for Cloud with a scheduled time window that matches the pipeline's deployment schedule

Answer

Configure a PowerShell script in the pipeline to modify the network security group (NSG) to allow the agent's IP during deployment

Answer

Assign a static public IP to the Azure DevOps agent and add that IP to the JIT allowed list permanently

Question 3

A security team uses Microsoft Defender for Cloud to centralize security alerts. They want to continuously export all security alerts to a Log Analytics workspace for long-term retention and custom analysis. Which two actions must be taken to achieve this? (Choose two that apply.)

Accepted Answer

Enable the continuous export feature in Microsoft Defender for Cloud.. Option A is correct because Microsoft Defender for Cloud's continuous export feature allows you to stream security alerts and recommendations to a Log Analytics workspace or Event Hubs at the subscription or tenant level. This feature is designed specifically for ongoing export, supporting long-term retention and custom analysis without manual intervention.

Answer

Create a Log Analytics workspace in the same region as the resources.

Answer

Assign an Azure Policy definition for 'Deploy export to Log Analytics workspace for Azure Security Center data'.

Question 4

A security operations team uses Microsoft Sentinel. They have created a playbook that sends an email notification to the security team when a high-severity incident is created by a specific analytics rule named 'CriticalRDPAccess'. They want the playbook to trigger automatically only when the incident has severity 'High' AND the incident was created by the rule named 'CriticalRDPAccess'. Which automation rule configuration should they use?

Accepted Answer

Condition: Incident severity equals High; AND Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.. Option C is correct because the automation rule must use the AND operator to require both conditions—incident severity equals 'High' AND incident rule name equals 'CriticalRDPAccess'—to trigger the playbook. This ensures the playbook runs only when both criteria are met, matching the requirement exactly. Using 'contains' instead of 'equals' (as in Option A) would incorrectly match rules with 'CriticalRDPAccess' as a substring, potentially triggering on unintended rules.

Answer

Condition: Incident severity equals High; AND Incident rule name contains 'CriticalRDPAccess'. Action: Run playbook.

Answer

Condition: Incident severity equals High; OR Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.

Answer

Condition: Incident severity in ['High', 'Critical']; AND Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.

Question 5

A security operations team uses Microsoft Sentinel. They create a playbook that changes the severity of an incident from 'Medium' to 'High' when a specific indicator of compromise (IOC) is detected within the incident's entities. The team wants this playbook to run automatically as soon as the incident is created, without manual intervention. Which type of automation rule trigger should they configure to invoke the playbook?

Accepted Answer

When incident is created. Option A is correct because the 'When incident is created' trigger in Microsoft Sentinel automation rules is designed to invoke a playbook immediately upon incident generation, without requiring any manual action. This matches the requirement for automatic execution as soon as the incident is created, allowing the playbook to evaluate entities and change severity from 'Medium' to 'High' based on the IOC detection.

Answer

When incident is updated

Answer

When alert is created

Answer

On a time schedule

Question 6

A security team uses Microsoft Sentinel. They create a scheduled analytics rule that queries Azure Activity Logs to detect virtual machines deployed in non-approved regions. The rule generates an incident. The team wants the incident to be automatically assigned to the 'Infrastructure' team and its severity set to 'High' when it is created. Which automation feature should they use?

Accepted Answer

Create an automation rule with trigger 'When incident is created' and actions to assign the incident to an owner and set severity. Option A is correct because automation rules in Microsoft Sentinel allow you to define triggers such as 'When incident is created' and then perform actions like assigning the incident to an owner and setting its severity. This is the native, no-code way to automate incident management without requiring a playbook or modifying the analytics rule itself.

Answer

Create a playbook triggered by alert creation that performs the assignment and severity change

Answer

Use an automation rule with trigger 'When incident is updated' and condition on alert type

Answer

Configure the analytics rule directly to set severity and owner

Question 7

A security team uses Microsoft Defender for Cloud. They have assigned a custom regulatory compliance initiative that includes policies to enforce encryption on storage accounts and SQL databases. They want to automatically remediate any non-compliant resources as soon as they are created, without manual intervention. Which feature should they configure?

Accepted Answer

Azure Policy with a 'DeployIfNotExists' effect. The 'DeployIfNotExists' effect in Azure Policy automatically deploys a resource (e.g., encryption configuration) when a non-compliant resource is created or updated, without manual intervention. This aligns with the requirement to remediate non-compliant storage accounts and SQL databases as soon as they are provisioned, as part of a custom regulatory compliance initiative assigned via Defender for Cloud.

Answer

Security policies (assignments)

Answer

Just-in-time VM access

Answer

Adaptive application controls

Question 8

A company uses Microsoft Defender for Cloud. They have assigned a custom regulatory compliance initiative that includes policies to enforce encryption on storage accounts and SQL databases. They want to automatically remediate any non-compliant resources that are discovered, without manual intervention. Which feature should they configure?

Accepted Answer

Enable 'Remediation' for each policy assignment in the custom initiative. Option B is correct because the 'Remediation' setting on a policy assignment in Azure Policy (used by Defender for Cloud custom initiatives) creates a managed identity and a remediation task that automatically applies the required encryption configuration to non-compliant resources. This ensures that when a storage account or SQL database is found without encryption, the policy engine triggers a deployment to enforce encryption without manual intervention.

Answer

Enable 'Auto provisioning' for the relevant extensions

Answer

Enable 'Just-in-time (JIT) VM access'

Answer

Enable 'Workflow automation' to trigger a Logic App when non-compliance is detected

Question 9

A security team uses Microsoft Sentinel. They want to create a custom detection rule that identifies a potential data exfiltration scenario: when a user signs in from an unusual location and then, within 30 minutes, performs a large download from Azure Blob Storage. They need to correlate sign-in logs from Azure AD with storage diagnostic logs. Which type of analytics rule should they create in Microsoft Sentinel?

Accepted Answer

A scheduled query rule using KQL. A scheduled query rule is correct because it allows you to write a KQL query that joins Azure AD sign-in logs (SigninLogs) with Azure Storage diagnostic logs (StorageBlobLogs) based on a user identifier, and then uses a time window (e.g., 30 minutes) to correlate the two events. This is the only rule type that supports custom KQL logic for multi-table joins and time-based correlation, which is essential for detecting the described exfiltration pattern.

Answer

An NRT (near-real-time) rule

Answer

A fusion rule

Answer

A machine learning-based analytics rule

Question 10

A security team uses Microsoft Defender for Cloud to protect Azure virtual machines. They want to implement application allowlisting to prevent execution of unauthorized software on a set of Windows Server VMs. They need to create a baseline of allowed applications and then enforce the allowlist. Which Defender for Cloud feature should they enable?

Accepted Answer

Adaptive application controls. Adaptive application controls (AAC) in Microsoft Defender for Cloud is the correct feature because it specifically provides application allowlisting for Azure VMs. AAC uses machine learning to analyze processes running on a VM, generate a baseline of allowed applications, and then enforce that allowlist by blocking execution of any unauthorized software. This directly meets the requirement to create a baseline and enforce it on Windows Server VMs.

Answer

Just-in-time VM access

Answer

File integrity monitoring

Answer

Adaptive network hardening

Question 11

A security team uses Microsoft Defender for Cloud. They want to ensure that all Azure virtual machines have the guest configuration extension installed to apply a security baseline automatically. They need to remediate non-compliant VMs without manual intervention. Which Defender for Cloud feature should be configured?

Accepted Answer

Assign a security policy (built-in initiative) that includes a policy with DeployIfNotExists effect. Option A is correct because the guest configuration extension is deployed automatically via a DeployIfNotExists policy effect within a built-in initiative (such as the Azure Security Benchmark). This effect evaluates VMs for the extension and, if missing, deploys it without manual intervention, ensuring the security baseline is applied. Defender for Cloud uses this policy-driven approach to remediate non-compliant resources at scale.

Answer

Enable automatic provisioning of the Log Analytics agent

Answer

Create an Automation rule that triggers a runbook when a recommendation appears

Answer

Configure a workflow automation scheduled task

Question 12

A security team uses Microsoft Defender for Cloud to monitor the security posture of a hybrid environment that includes on-premises servers connected via Azure Arc. They want to enable a vulnerability assessment solution that automatically scans all servers (both Azure VMs and on-premises Arc-enabled servers) for OS vulnerabilities. Which solution should they enable directly from Defender for Cloud?

Accepted Answer

Enable the integrated vulnerability assessment solution (Qualys) in Defender for Cloud. The integrated vulnerability assessment (VA) solution in Defender for Cloud, powered by Qualys, is the correct choice because it is a native, built-in capability that can be automatically enabled for both Azure VMs and Azure Arc-enabled on-premises servers. It requires no additional licensing or external configuration, and it automatically discovers and scans OS vulnerabilities without manual intervention, directly from the Defender for Cloud portal.

Answer

Enable Microsoft Defender for Endpoint and integrate it with Defender for Cloud

Answer

Configure Azure Update Management to assess missing patches

Answer

Use Azure Policy to deploy the Log Analytics agent and manually enable scanning

Question 13

A security team wants to use Microsoft Sentinel to detect potential data exfiltration events from Azure Blob Storage. Which two logs should they ingest to best identify unauthorized read access and data transfer activities? (Choose two.)

Accepted Answer

Storage account audit logs (e.g., StorageReadKey, GetBlob). Option A is correct because Storage account audit logs (e.g., StorageReadKey, GetBlob) capture detailed data-plane operations, including read access to blobs and keys, which directly indicates potential data exfiltration. Option B is correct because the Azure Activity log for storage account write operations records management-plane events like storage account key regeneration, which can be used to bypass existing access controls and exfiltrate data. Together, these logs provide visibility into both the data access and the administrative actions that could enable exfiltration.

Answer

Azure AD sign-in logs

Answer

Azure Key Vault audit logs

Question 14

A security analyst uses Microsoft Defender for Cloud. They need to continuously monitor the security posture of their Azure subscription against the Microsoft cloud security benchmark (MCSB). They want to see the current compliance score and specific recommendations for failing controls. Which Defender for Cloud feature should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud is specifically designed to track compliance against standards like the Microsoft cloud security benchmark (MCSB). It provides a current compliance score and lists specific recommendations for failing controls, enabling continuous monitoring and remediation tracking. This dashboard aggregates assessment results from the secure score and maps them to the controls defined in the selected regulatory standard.

Answer

Security posture

Answer

Workbooks

Answer

Advanced hunting

Question 15

A company uses Microsoft Defender for Cloud to monitor its security posture. The compliance team wants to receive email notifications immediately when a control in the ISO 27001 regulatory compliance standard fails. They want to be alerted only when specific controls change from 'compliant' to 'non-compliant'. Which feature should they configure?

Accepted Answer

Workflow automation based on regulatory compliance assessment changes. Option C is correct because workflow automation in Microsoft Defender for Cloud can be configured to trigger based on regulatory compliance assessment changes, specifically when a control transitions from 'compliant' to 'non-compliant'. This allows the compliance team to receive immediate email notifications for ISO 27001 control failures without manual polling or dashboard monitoring.

Answer

Security Alerts from Microsoft Defender for Cloud

Answer

Regulatory Compliance dashboard with continuous export

Answer

Custom recommendations in Microsoft Defender for Cloud