AZ-500 Manage identity and access Practice Test 8 — 15 Questions

Question 1

A security analyst uses Microsoft Defender for Cloud to monitor the security posture of their Azure subscription. They want to receive an email notification whenever a high-severity security alert is generated for any of their Azure resources. What should they configure in Defender for Cloud?

Accepted Answer

Configure email notifications in the Defender for Cloud settings under 'Notifications'.. Option B is correct because Microsoft Defender for Cloud has a built-in 'Email notifications' setting under its environment settings that allows you to configure email recipients for high-severity alerts directly, without needing external services. This feature sends real-time email notifications for security alerts based on severity levels you define, making it the simplest and most direct method for this requirement.

Answer

Create an alert rule in Azure Monitor that triggers an email when a security alert is raised.

Answer

Use a Logic Apps playbook to send an email when a new alert is generated.

Answer

Set up a workflow automation rule in Microsoft Sentinel to forward alerts to email.

Question 2

A security team uses Microsoft Sentinel. They want to create a playbook that automatically adds a tag 'isolated' to any Azure virtual machine that triggers a high-severity security alert. How should they configure the automation?

Accepted Answer

Create a playbook in Logic Apps and attach it to the alert as an automation rule. Option B is correct because Microsoft Sentinel playbooks are built on Azure Logic Apps and can be triggered by automation rules. An automation rule is configured to run when a high-severity alert is generated, and it invokes the playbook, which then uses the Azure Resource Manager connector to add the 'isolated' tag to the triggering virtual machine. This is the native, supported method for automated incident response in Sentinel.

Answer

Create an analytics rule with an automated response

Answer

Use a workbook to trigger the playbook

Answer

Configure a data connector

Question 3

A security team uses Microsoft Defender for Cloud. They want to receive a weekly email summary of the Secure Score, top recommendations, and new alerts for their subscription. Which feature should they configure?

Accepted Answer

Enable the 'Weekly email summary' option in the Defender for Cloud email notifications settings.. Option A is correct because Defender for Cloud includes a built-in 'Email notifications' settings page where you can enable a weekly email summary that automatically delivers the Secure Score, top recommendations, and new alerts. This feature is designed specifically for periodic, high-level security posture summaries without requiring custom infrastructure.

Answer

Configure continuous export to export all security data to a Log Analytics workspace and use a workbook to create a summary.

Answer

Create a workflow automation that triggers on a schedule and uses a Logic App to send an email summary.

Answer

Enable the 'Security Policy' default initiative to automatically send reports.

Question 4

A security operations team uses Microsoft Sentinel. They want to automatically assign incidents to different tiers of analysts based on severity when incidents are created. Which feature should they configure?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific analysts or teams based on criteria such as severity. When an incident is created, the automation rule triggers and can set the owner (assignee) to a predefined user or group, enabling tiered assignment without manual intervention.

Answer

Fusion - Advanced Multistage Attack Detection

Answer

Analytics rules with scheduled queries

Answer

Playbooks

Question 5

A company uses Microsoft Defender for Cloud. They want to automatically implement a specific security recommendation (e.g., 'Enable encryption for Azure SQL Database') on all existing and future SQL Database instances in a subscription. Which feature should they use?

Accepted Answer

Security policy with a custom initiative.. A custom initiative in a security policy allows you to define a set of security recommendations (e.g., 'Enable encryption for Azure SQL Database') and enforce them via Azure Policy. By assigning this initiative at the subscription scope with a 'DeployIfNotExists' or 'Modify' effect, you can automatically remediate non-compliant resources and ensure that all existing and future SQL Database instances have encryption enabled. This is the correct mechanism for automated, continuous compliance with custom security requirements.

Answer

Regulatory compliance dashboard.

Answer

Workload protection plans.

Answer

Vulnerability assessment.

Question 6

A security operations team uses Microsoft Sentinel. They need to collect Syslog messages from on-premises Linux servers for analysis. Which data connector should they use to ingest these logs into Sentinel?

Accepted Answer

Syslog connector via Log Analytics agent. The Syslog connector via Log Analytics agent is the correct choice because it allows Microsoft Sentinel to collect Syslog messages from on-premises Linux servers. The Log Analytics agent (formerly OMS agent) listens on UDP port 514 (or a custom port) for Syslog messages forwarded by the Linux rsyslog or syslog-ng daemon, then forwards them to the Log Analytics workspace. This connector is specifically designed for standard Syslog ingestion without requiring format transformation.

Answer

Azure Activity Log connector

Answer

Common Event Format (CEF) connector

Answer

Windows Security Events connector

Question 7

A security team wants to receive a weekly email summary of the security posture of all their Azure subscriptions, including the Secure Score, top recommendations, and the number of healthy resources. Which Microsoft Defender for Cloud feature should they configure?

Accepted Answer

Email notifications for weekly digest. Option B is correct because the 'Email notifications for weekly digest' feature in Microsoft Defender for Cloud is specifically designed to send a weekly summary of security posture, including Secure Score, top recommendations, and healthy resources, directly to specified email recipients. This feature is configured under Defender for Cloud's 'Email notifications' settings, where you can enable the weekly digest and define the recipients.

Answer

Continuous export to a Log Analytics workspace

Answer

Automation rules to trigger a Logic App on a schedule

Answer

Workflow automation to export data daily

Question 8

A security analyst uses Microsoft Defender for Cloud. They need to view the current compliance status of their Azure subscription against the Payment Card Industry Data Security Standard (PCI DSS). Which feature in Defender for Cloud should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of your Azure subscription's compliance posture against specific standards like PCI DSS. It continuously assesses your resources against the controls defined in the selected compliance framework and displays a compliance score, passed/failed controls, and remediation steps. This is the dedicated feature for tracking regulatory compliance, not general security posture or vulnerability management.

Answer

Security posture dashboard

Answer

Vulnerability assessment solutions

Answer

Workflow automation

Question 9

An organization uses Microsoft Defender for Cloud. They want to receive alerts when Azure virtual machines do not have disk encryption enabled. What should they configure to achieve this?

Accepted Answer

A security policy recommendation in Defender for Cloud. Option C is correct because Defender for Cloud's security policy recommendations include 'Disk encryption should be applied on virtual machines' as a built-in recommendation. When enabled, Defender for Cloud continuously assesses VMs against this recommendation and generates alerts for non-compliant resources. This is the native mechanism within Defender for Cloud to monitor and alert on missing disk encryption without requiring external tools or custom rules.

Answer

A custom alert rule in Microsoft Sentinel

Answer

A regulatory compliance standard in Defender for Cloud

Answer

An Azure Policy initiative

Question 10

A security operations team uses Microsoft Sentinel. They want to enable User and Entity Behavior Analytics (UEBA) to detect anomalous user activities. Which configuration is required?

Accepted Answer

Enable UEBA in the Sentinel settings. UEBA in Microsoft Sentinel is a built-in feature that must be explicitly enabled in the Sentinel configuration settings under 'Entity behavior analytics'. It does not require a separate data connector or analytics rule template; once enabled, Sentinel automatically ingests and analyzes existing log data (e.g., Azure AD sign-ins, Office 365 audit logs) to establish behavioral baselines and detect anomalies.

Answer

Install the UEBA data connector

Answer

Create an analytics rule with UEBA template

Answer

Assign the Security Reader role to Sentinel

Question 11

A company uses Microsoft Defender for Cloud. They want to receive alerts when a virtual machine has a vulnerability that is rated 'Critical' by the integrated vulnerability assessment solution. Which Defender for Cloud plan must be enabled?

Accepted Answer

Defender for Servers plan (P2 or P1). The integrated vulnerability assessment solution in Microsoft Defender for Cloud relies on the Qualys or Microsoft Defender Vulnerability Management (MDVM) agent, which is only available with the Defender for Servers plan. The P2 tier includes the full vulnerability assessment capabilities, while P1 provides foundational coverage; both can generate alerts for critical vulnerabilities. Without this plan, the vulnerability assessment engine is not active, so no critical alerts will be produced.

Answer

Defender for Cloud's free foundational CSPM

Answer

Defender for Storage plan

Answer

Defender for SQL plan

Question 12

A company uses Microsoft Defender for Cloud. They want to receive email notifications when a high-severity security alert is generated for any resource in the subscription. Which configuration should they make in Defender for Cloud?

Accepted Answer

Configure the 'Email notifications' setting in Defender for Cloud to send alerts to the required email addresses.. Option A is correct because the 'Email notifications' setting in Microsoft Defender for Cloud allows you to directly configure email recipients to receive notifications for high-severity alerts. This built-in feature sends emails to specified addresses whenever a high-severity security alert is triggered for any resource in the subscription, without requiring additional automation or external tools.

Answer

Create a workflow automation in Defender for Cloud that sends an email when a high-severity alert is generated.

Answer

Enable continuous export to stream all security alerts to a Log Analytics workspace and create an alert rule to send email.

Answer

Enable the 'Send email alerts' option in the Azure Monitor activity log alert rule.

Question 13

A security analyst uses Microsoft Defender for Cloud. They want to view a list of all security recommendations for their Azure subscription, prioritized by their potential impact. Which Defender for Cloud dashboard should they use?

Accepted Answer

Secure Score. The Secure Score dashboard in Microsoft Defender for Cloud provides a prioritized list of security recommendations based on their potential impact on your overall security posture. Each recommendation is assigned a score contribution, allowing you to focus on the actions that will most improve your secure score. This directly matches the requirement to view recommendations prioritized by impact.

Answer

Regulatory Compliance

Answer

Inventory

Answer

Workload protections

Question 14

A security engineer connects Azure virtual machines to Microsoft Defender for Cloud. The team wants vulnerability findings without installing a vulnerability scanner extension on each VM. Which capability should be enabled?

Accepted Answer

Agentless vulnerability assessment for machines in Defender for Servers. Agentless vulnerability assessment for machines in Defender for Servers is the correct capability because it uses Microsoft Defender for Cloud's built-in scanning engine to assess VMs for vulnerabilities without requiring any agent or extension installation. This feature leverages the VM's existing configuration and cloud APIs to perform scans, meeting the team's requirement to avoid installing a vulnerability scanner extension on each VM.

Answer

Microsoft Sentinel User and Entity Behavior Analytics

Answer

Azure Firewall threat intelligence mode

Answer

Microsoft Entra Identity Protection sign-in risk

Question 15

A Sentinel analytics rule creates a new incident every time the same brute-force activity is detected for the same account within an hour. The SOC wants one incident that continues to group related alerts. What should be changed?

Accepted Answer

Configure incident grouping in the scheduled analytics rule. Option B is correct because incident grouping in a scheduled analytics rule allows multiple alerts triggered by the same entity (e.g., the same account) within a specified time window to be combined into a single incident. By configuring the 'Group related alerts into a single incident' setting and setting the grouping window to one hour, the SOC ensures that all brute-force alerts for the same account are merged into one incident, reducing alert fatigue and providing a consolidated view of the attack.

Answer

Disable entity mapping for the account entity

Answer

Change the rule query to use project-away on TimeGenerated

Answer

Run the rule as a near-real-time rule