AZ-500 Manage identity and access Practice Test 7 — 15 Questions

Question 1

A company uses Defender for Servers Plan 2. Which two capabilities are included compared with a basic posture-only configuration?

Accepted Answer

File integrity monitoring or equivalent advanced server protection capabilities. Defender for Servers Plan 2 includes advanced server protection capabilities such as file integrity monitoring (FIM), which tracks changes to critical system files and registry keys, and endpoint detection and response (EDR) integration through Microsoft Defender for Endpoint. These capabilities go beyond the basic posture-only configuration, which only provides vulnerability assessment and security recommendations without real-time threat detection or file change monitoring.

Answer

Azure Cost Management budget alerts

Answer

Microsoft 365 message trace

Question 2

An analyst creates a Sentinel automation rule and a playbook. The playbook should run only when incidents are created from a specific analytics rule and severity is High. Where should this filtering be configured?

Accepted Answer

Automation rule conditions. Automation rules in Microsoft Sentinel are designed to trigger actions based on incident creation or update events. By configuring conditions within the automation rule, you can specify that the associated playbook should only run when the incident is created from a specific analytics rule and has a severity of High. This is the correct and intended location for such filtering, as automation rules evaluate conditions before invoking the playbook.

Answer

Logic App recurrence trigger

Answer

Log Analytics workspace retention settings

Answer

Analytics rule suppression only

Question 3

A security team wants to visualize MITRE ATT&CK coverage for Microsoft Sentinel analytics rules. Which Sentinel experience should they use?

Accepted Answer

MITRE ATT&CK coverage in analytics/content hub views. The MITRE ATT&CK coverage view in the Microsoft Sentinel analytics/content hub provides a direct mapping between configured analytics rules and specific MITRE ATT&CK techniques. This allows security teams to visually identify gaps in detection coverage by seeing which techniques are covered by active rules and which are not, enabling targeted rule deployment.

Answer

Hunting bookmarks

Answer

Watchlists

Answer

Data collection endpoints

Question 4

A KQL hunting query joins SecurityIncident with SecurityAlert but returns duplicate rows for incidents with multiple alerts. What KQL approach best preserves one row per incident while summarizing alert details?

Accepted Answer

Use summarize make_set() or arg_max() grouped by IncidentNumber. `summarize make_set()` or `arg_max()` grouped by `IncidentNumber` collapses multiple alert rows into a single incident row while preserving alert details in an array or the most recent alert. This directly addresses the duplicate rows caused by a one-to-many join between SecurityIncident and SecurityAlert, ensuring one row per incident without data loss.

Answer

Use order by TimeGenerated desc only

Answer

Replace join with union

Answer

Use take 1 before the join

Question 5

A DevOps team wants Defender for Cloud to identify secrets exposed in GitHub repositories. What should be configured?

Accepted Answer

Defender for Cloud DevOps Security connector. Defender for Cloud's DevOps Security connector integrates with GitHub to scan repositories for exposed secrets (e.g., API keys, tokens) using Microsoft's secret scanning engine. This connector enables Defender for Cloud to monitor commits and pull requests, alerting on secrets detected in code. It is the correct solution because it directly addresses the requirement to identify secrets in GitHub repositories within the Defender for Cloud ecosystem.

Answer

Azure Bastion native client

Answer

Sentinel Syslog connector

Answer

Azure Storage lifecycle management

Question 6

A team wants Sentinel to ingest firewall logs from an appliance that emits Common Event Format over Syslog. Which connector pattern is most appropriate?

Accepted Answer

CEF connector using a Linux log forwarder or AMA-supported collection path. The Common Event Format (CEF) over Syslog is a standard logging format used by many security appliances. Sentinel's CEF connector is specifically designed to ingest these logs, typically using a Linux log forwarder (rsyslog or syslog-ng) or the Azure Monitor Agent (AMA) with a Data Collection Rule to parse and forward the CEF messages to the Log Analytics workspace.

Answer

Azure Activity connector

Answer

Microsoft Entra ID Protection connector

Answer

Office 365 connector

Question 7

A Defender for Cloud secure score recommendation says storage accounts allow public blob access. What remediation best addresses the root issue?

Accepted Answer

Disable public blob access at the storage account level and review container ACLs. The secure score recommendation indicates that storage accounts allow public blob access, which is a security risk. The root cause is that anonymous access is enabled at the storage account level, and individual container ACLs may also permit public access. Disabling public blob access at the storage account level (via the 'AllowBlobPublicAccess' property) immediately blocks all anonymous requests, and reviewing container ACLs ensures no residual permissions exist. This directly addresses the vulnerability by enforcing a deny-by-default posture.

Answer

Enable storage account static website hosting

Answer

Increase Log Analytics retention

Answer

Create an Azure Front Door profile

Question 8

An organization wants to detect when a privileged Azure role assignment is created outside the approved change window. Which log source should a Sentinel rule query?

Accepted Answer

AzureActivity. AzureActivity logs capture all control-plane operations on Azure resources, including role assignment creations (e.g., 'Microsoft.Authorization/roleAssignments/write'). By querying AzureActivity in a Sentinel rule, you can detect when a privileged role assignment is made outside an approved change window. Heartbeat, Perf, and StorageBlobLogs do not record Azure RBAC changes.

Answer

Heartbeat

Answer

Perf

Answer

StorageBlobLogs

Question 9

A Sentinel analyst needs to preserve investigation notes, related entities, and ownership while escalating a case to another analyst. Which object should be updated?

Accepted Answer

The Sentinel incident. The Sentinel incident object is the correct entity to update because it serves as the central container for investigation notes, related entities, and ownership assignments during case escalation. Updating the incident preserves the full investigation context—including comments, tags, and assigned owner—ensuring seamless handoff between analysts without data loss.

Answer

A watchlist item

Answer

A workbook parameter

Answer

A data connector

Question 10

A security engineer needs to collect custom application logs from Azure VMs using Azure Monitor Agent for Sentinel analysis. Which two components are required?

Accepted Answer

A Data Collection Rule that defines the custom log collection. A Data Collection Rule (DCR) is required to define the schema, transformation, and destination for custom application logs ingested by Azure Monitor Agent. Without a DCR, the agent has no configuration for which custom logs to collect or how to process them. However, the DCR alone is insufficient; it must be associated with the target Azure VMs (via a Data Collection Rule Association) so that the agent on those VMs knows to apply the rule and begin collecting the specified custom logs. Both components are necessary for successful custom log ingestion into Azure Monitor and Sentinel.

Answer

A storage account configured for static website hosting

Answer

A Conditional Access policy requiring MFA

Question 11

A Microsoft Sentinel rule should run with minimal delay against supported data sources and produce alerts close to event time. Which rule type should be considered?

Accepted Answer

Near-real-time analytics rule. Near-real-time (NRT) analytics rules in Microsoft Sentinel are designed to run at 1-minute intervals, providing the minimal delay for alert generation against supported data sources. This rule type queries data with low latency, ensuring alerts are produced close to the event time, which is critical for timely threat detection.

Answer

Fusion rule

Answer

Workbook query

Answer

Threat intelligence indicator import

Question 12

A Defender for Cloud recommendation requires enabling private endpoints for a storage account. Which security risk is primarily reduced?

Accepted Answer

Public internet exposure of the storage service endpoint. Enabling private endpoints for a storage account connects it to an Azure Virtual Network over a private IP address, eliminating access from the public internet. This directly reduces the risk of public internet exposure of the storage service endpoint (Option B). The primary risk addressed is network-level exposure, not identity-related risks like unauthorized changes to Azure AD users (Option C). While private endpoints can contribute to a defense-in-depth strategy, the most immediate and primary risk reduction is the removal of public network accessibility.

Answer

VM disk fragmentation

Answer

Unauthorized changes to Azure AD users

Answer

Excessive Log Analytics ingestion

Question 13

A Sentinel watchlist contains high-value administrator accounts. Which KQL pattern best uses it in a detection rule?

Accepted Answer

Load the watchlist with _GetWatchlist() and join or filter SigninLogs by the account identifier. The `_GetWatchlist()` function in KQL allows you to dynamically load a Sentinel watchlist into a query. By joining or filtering `SigninLogs` against the watchlist's account identifier field, you can create a detection rule that triggers only when a high-value administrator account (defined in the watchlist) performs a sign-in, enabling precise, automated alerting without manual intervention.

Answer

Export the watchlist to CSV and manually compare it after alerts fire

Answer

Use the watchlist as a replacement for the SigninLogs table

Answer

Attach the watchlist to a workbook without changing the detection query

Question 14

A company wants to identify excessive permissions across Azure, AWS, and GCP identities. Which Microsoft security capability is designed for cloud infrastructure entitlement management?

Accepted Answer

Microsoft Entra Permissions Management. Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility into permissions assigned to identities across multi-cloud environments (Azure, AWS, GCP). It helps detect and remediate excessive, unused, or risky permissions by analyzing identity activity and entitlement data, enabling least-privilege access control.

Answer

Azure Monitor metrics

Answer

Microsoft Purview eDiscovery

Answer

Azure Front Door WAF

Question 15

A team wants Sentinel incidents to automatically assign to the Tier 2 queue when severity is High and the product name is Microsoft Defender for Endpoint. What should they configure?

Accepted Answer

An automation rule that updates owner/status based on conditions. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners or queues based on conditions like severity and product name. By configuring an automation rule with a condition that triggers when severity equals 'High' and the product name is 'Microsoft Defender for Endpoint', you can set the incident owner to a specific user or group (e.g., Tier 2 queue) and optionally update the status. This directly meets the requirement without manual intervention.

Answer

A workbook with a dropdown filter

Answer

A watchlist containing Tier 2 users only

Answer

A data retention policy