AZ-500 Manage identity and access Practice Test 9 — 15 Questions

Question 1

A KQL query in Microsoft Sentinel detects impossible travel but returns many false positives from known VPN egress IP addresses. Which two changes would best reduce noise while preserving useful detections?

Accepted Answer

Join or filter against a watchlist of approved VPN egress IPs. Option A is correct because integrating a watchlist of known VPN egress IPs allows the KQL query to filter out these trusted IPs, reducing false positives from impossible travel detections. Option C is also correct because excluding events where the source IP is in an approved network list directly removes noise from legitimate VPN traffic, preserving detection of truly anomalous sign-ins. Both approaches leverage Sentinel's watchlist or allowlist capabilities to maintain detection fidelity while minimizing alert fatigue.

Answer

Disable the SigninLogs connector for the tenant

Answer

Raise the query frequency from 1 hour to 24 hours

Question 2

A company wants Defender for Cloud to automatically open a Logic App when a high-severity alert is generated for a subscription. Which feature should be configured?

Accepted Answer

Workflow automation. Workflow automation in Defender for Cloud allows you to trigger a Logic App automatically in response to specific security alerts, such as high-severity alerts. This feature uses Azure Event Grid to listen for alert creation events and invoke the Logic App via an HTTP trigger, enabling automated remediation or notification workflows without manual intervention.

Answer

Regulatory compliance dashboard

Answer

Secure score recommendation exemption

Answer

Continuous export

Question 3

A Sentinel playbook fails to update incidents even though the Logic App runs successfully. The playbook uses a managed identity. What is the most likely missing configuration?

Accepted Answer

The managed identity lacks Microsoft Sentinel Responder or Contributor permissions on the workspace. The managed identity assigned to the Logic App must have at least Microsoft Sentinel Responder or Contributor permissions on the workspace to update incidents. Without these RBAC roles, the Logic App's API calls to modify incident properties (e.g., status, severity) are denied, even if the Logic App itself runs without errors.

Answer

The analytics rule does not include MITRE ATT&CK tactics

Answer

The Log Analytics workspace is not linked to Azure Monitor Private Link

Answer

The incident title does not contain an entity mapping

Question 4

An organization wants to export Defender for Cloud recommendations and alerts into a central Log Analytics workspace for retention and hunting. Which feature should they use?

Accepted Answer

Continuous export. Continuous export is the correct feature because it allows you to stream Defender for Cloud security alerts and recommendations to a Log Analytics workspace for long-term retention and custom hunting queries. This feature supports both real-time and scheduled export of security data, enabling centralized monitoring and compliance auditing. It directly addresses the requirement to export Defender for Cloud data into a Log Analytics workspace without additional third-party tools.

Answer

Microsoft Defender External Attack Surface Management

Answer

Microsoft Entra access reviews

Answer

Azure Monitor autoscale

Question 5

A SOC analyst needs a Sentinel query that detects multiple failed sign-ins followed by a successful sign-in for the same user. Which table is the best primary source?

Accepted Answer

SigninLogs. SigninLogs is the correct primary source because it captures both failed and successful user sign-in events from Azure AD, including interactive and non-interactive logins. This table provides the necessary fields like ResultType (e.g., 0 for success, 50125 for failure) and UserPrincipalName to build a KQL query that detects a sequence of failed sign-ins followed by a successful one for the same user.

Answer

SecurityAlert

Answer

AzureActivity

Answer

DeviceNetworkEvents

Question 6

A cloud security team wants Defender for Cloud to assess AWS accounts and GCP projects from the same portal used for Azure posture management. What should they configure?

Accepted Answer

Environment settings with multicloud connectors. Option A is correct because Defender for Cloud's multicloud connectors allow you to onboard AWS accounts and GCP projects directly into the Azure portal, enabling unified security posture management across all three cloud environments. This feature integrates with AWS Security Hub and GCP Security Command Center to aggregate findings and assessments into a single dashboard, without requiring any migration of workloads.

Answer

Azure Arc-enabled Kubernetes only

Answer

Microsoft Sentinel data connector for AWS CloudTrail only

Answer

Azure Lighthouse delegation

Question 7

A Defender for Cloud recommendation is valid for most subscriptions but not for a legacy subscription with an approved exception. The team wants secure score to reflect the exception without disabling the recommendation everywhere. What should they do?

Accepted Answer

Create an exemption for the affected scope with a justification. Option C is correct because Azure Policy exemptions allow you to exclude a specific scope (e.g., a subscription or resource group) from a policy or initiative effect while still having the policy enforced elsewhere. By creating an exemption for the legacy subscription with a justification, the Defender for Cloud recommendation remains active for all other subscriptions, and the secure score calculation will correctly reflect the exception without disabling the recommendation globally.

Answer

Delete the built-in initiative from the management group

Answer

Change the recommendation severity to Low

Answer

Disable Defender for Cloud on the legacy subscription

Question 8

A team enables Microsoft Defender for Storage. Which two threats can the plan help detect?

Accepted Answer

Access from suspicious IP addresses to storage accounts. Microsoft Defender for Storage detects anomalous activities that could indicate threats to storage accounts. Option A is correct because the service analyzes incoming requests to identify access from suspicious IP addresses, such as known malicious IPs or Tor exit nodes, using threat intelligence feeds. Option D is correct because when malware scanning is enabled, Defender for Storage can detect malware uploaded to Blob Storage by scanning files for known malicious signatures.

Answer

Expired Azure AD PIM role assignments

Answer

Public IP address creation on virtual machines

Question 9

A Sentinel scheduled rule runs every 5 minutes and looks back 1 hour. Analysts see repeated alerts for the same event. Which change best prevents duplicate detections without missing late-arriving logs?

Accepted Answer

Use an ingestion-time or event-time exclusion window in the query. Option B is correct because using an ingestion-time or event-time exclusion window in the query allows the rule to skip events that have already generated an alert within a specific time range, preventing duplicate detections while still accommodating late-arriving logs. This approach leverages the query logic to filter out duplicates based on a time-based deduplication key, ensuring that only new or unique events trigger alerts without altering the lookback period.

Answer

Reduce the query lookback to 1 minute

Answer

Disable alert grouping

Answer

Change the workspace retention period

Question 10

A company wants to detect exposed internet-facing assets that are not yet known in its Azure inventory. Which Microsoft Defender capability is most relevant?

Accepted Answer

Defender External Attack Surface Management. Defender External Attack Surface Management (EASM) is specifically designed to discover and inventory internet-facing assets (e.g., domains, IPs, open ports, certificates) that are not yet known to an organization's Azure inventory. It continuously scans public attack surfaces to identify unknown or unmanaged resources, making it the most relevant capability for detecting exposed assets outside the current Azure footprint.

Answer

Defender for SQL vulnerability assessment

Answer

Microsoft Entra Permissions Management

Answer

Azure Monitor VM insights

Question 11

A Sentinel data connector based on Azure Monitor Agent stops collecting Windows Security Events after migration from the legacy agent. What should the engineer verify first?

Accepted Answer

A Data Collection Rule is associated with the target machines and includes the required event streams. After migrating from the legacy Log Analytics Agent to the Azure Monitor Agent (AMA), data collection is governed by Data Collection Rules (DCRs). If the DCR is not associated with the target machines or does not include the required Windows Security Event data streams (e.g., `Microsoft-Event` or `SecurityEvent`), the Sentinel connector will stop receiving events. This is the most common root cause because AMA relies entirely on DCRs for configuration, unlike the legacy agent which used workspace settings directly.

Answer

The workspace has a saved KQL function named SecurityEvent

Answer

The machines are assigned an Azure Policy initiative for tags

Answer

The analytics rule is configured as near-real-time

Question 12

A team wants to automatically deploy Defender for Cloud settings across new subscriptions under a management group. Which Azure capability should they use?

Accepted Answer

Azure Policy initiative assignment. Azure Policy initiative assignments allow you to bundle multiple policy definitions (such as those for Defender for Cloud) and assign them at the management group scope. This ensures that all new subscriptions under that management group automatically inherit and enforce the Defender for Cloud settings, including enabling security monitoring and threat detection. This is the correct approach because Azure Policy provides continuous compliance evaluation and remediation at scale across the entire resource hierarchy.

Answer

Application security groups

Answer

Conditional Access templates

Answer

Sentinel workbooks

Question 13

A SOC wants a Sentinel rule to include account, host, and IP entities so analysts can pivot during investigation. What should be configured in the analytics rule?

Accepted Answer

Entity mapping. Entity mapping is the correct configuration because it explicitly links the analytics rule's results to known entity types (account, host, IP) in Microsoft Sentinel. This enables analysts to pivot directly from an alert to related entities in the investigation graph, enriching context without manual cross-referencing. Without entity mapping, the rule would generate alerts but lack the structured entity data needed for seamless pivot actions.

Answer

Custom details only

Answer

Suppression rules

Answer

Workbook parameters

Question 14

A company uses Defender for Servers Plan 2. Which two capabilities are included compared with a basic posture-only configuration?

Accepted Answer

File integrity monitoring or equivalent advanced server protection capabilities. Defender for Servers Plan 2 includes advanced server protection capabilities such as file integrity monitoring (FIM), which tracks changes to critical system files and registry keys, and endpoint detection and response (EDR) integration through Microsoft Defender for Endpoint. These capabilities go beyond the basic posture-only configuration, which only provides vulnerability assessment and security recommendations without real-time threat detection or file change monitoring.

Answer

Azure Cost Management budget alerts

Answer

Microsoft 365 message trace

Question 15

An analyst creates a Sentinel automation rule and a playbook. The playbook should run only when incidents are created from a specific analytics rule and severity is High. Where should this filtering be configured?

Accepted Answer

Automation rule conditions. Automation rules in Microsoft Sentinel are designed to trigger actions based on incident creation or update events. By configuring conditions within the automation rule, you can specify that the associated playbook should only run when the incident is created from a specific analytics rule and has a severity of High. This is the correct and intended location for such filtering, as automation rules evaluate conditions before invoking the playbook.

Answer

Logic App recurrence trigger

Answer

Log Analytics workspace retention settings

Answer

Analytics rule suppression only