AZ-500 Timed Practice Test 5 — 10 Questions

Question 1

Security analysts in your company use Microsoft Sentinel to manage incidents. They want to automatically assign any incident with a severity of 'High' or 'Critical' to the senior analyst on duty. Which Microsoft Sentinel feature should they configure to accomplish this?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific users or groups based on conditions such as severity. By creating an automation rule that triggers when an incident is created with a severity of 'High' or 'Critical', you can set the owner to the senior analyst on duty, fulfilling the requirement without manual intervention.

Answer

Playbooks

Answer

Workbooks

Answer

Analytics rules

Question 2

A KQL hunting query joins SecurityIncident with SecurityAlert but returns duplicate rows for incidents with multiple alerts. What KQL approach best preserves one row per incident while summarizing alert details?

Accepted Answer

Use summarize make_set() or arg_max() grouped by IncidentNumber. Option D is correct because `summarize make_set()` or `arg_max()` grouped by `IncidentNumber` collapses multiple alert rows into a single incident row while preserving alert details in an array or the most recent alert. This directly addresses the duplicate rows caused by a one-to-many join between SecurityIncident and SecurityAlert, ensuring one row per incident without data loss.

Answer

Use order by TimeGenerated desc only

Answer

Replace join with union

Answer

Use take 1 before the join

Question 3

A security team uses Microsoft Sentinel. They want to detect a potential privilege escalation scenario: when a user is added to the Global Administrator role in Azure AD (audit log) and within 10 minutes that user signs in from a suspicious location (sign-in log). Which type of analytics rule should they create to correlate these two different log sources?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that joins the AuditLogs table (for role assignment events) with the SigninLogs table (for sign-in events) and then uses a time window (e.g., 10 minutes) to correlate the two disparate log sources. This rule type supports cross-table joins and custom time-based correlation, which is exactly what is needed to detect a user added to Global Administrator followed by a suspicious sign-in.

Answer

Fusion rule

Answer

Anomaly rule

Answer

NRT rule (Near Real-Time)

Question 4

Traffic from a spoke VNet must reach the internet through a firewall in the hub VNet. What routing configuration is required on the spoke subnets?

Accepted Answer

A default route to the Azure Firewall private IP or virtual appliance next hop. To force spoke traffic to the internet through a firewall in the hub VNet, you must create a user-defined route (UDR) on the spoke subnet with an address prefix of 0.0.0.0/0 and a next hop of the Azure Firewall's private IP or the virtual appliance's IP. This overrides the default system route that would otherwise send internet-bound traffic directly out via Azure's edge, ensuring all egress traffic is inspected and controlled by the firewall.

Answer

A route to Internet with next hop Internet

Answer

An NSG deny rule for 0.0.0.0/0

Answer

A service endpoint policy

Question 5

A Sentinel analytics rule creates a new incident every time the same brute-force activity is detected for the same account within an hour. The SOC wants one incident that continues to group related alerts. What should be changed?

Accepted Answer

Configure incident grouping in the scheduled analytics rule. Option B is correct because incident grouping in a scheduled analytics rule allows multiple alerts triggered by the same entity (e.g., the same account) within a specified time window to be combined into a single incident. By configuring the 'Group related alerts into a single incident' setting and setting the grouping window to one hour, the SOC ensures that all brute-force alerts for the same account are merged into one incident, reducing alert fatigue and providing a consolidated view of the attack.

Answer

Disable entity mapping for the account entity

Answer

Change the rule query to use project-away on TimeGenerated

Answer

Run the rule as a near-real-time rule

Question 6

An organization wants to detect when a privileged Azure role assignment is created outside the approved change window. Which log source should a Sentinel rule query?

Accepted Answer

AzureActivity. AzureActivity logs capture all control-plane operations on Azure resources, including role assignment creations (e.g., 'Microsoft.Authorization/roleAssignments/write'). By querying AzureActivity in a Sentinel rule, you can detect when a privileged role assignment is made outside an approved change window. Heartbeat, Perf, and StorageBlobLogs do not record Azure RBAC changes.

Answer

Heartbeat

Answer

Perf

Answer

StorageBlobLogs

Question 7

A Sentinel data connector based on Azure Monitor Agent stops collecting Windows Security Events after migration from the legacy agent. What should the engineer verify first?

Accepted Answer

A Data Collection Rule is associated with the target machines and includes the required event streams. After migrating from the legacy Log Analytics Agent to the Azure Monitor Agent (AMA), data collection is governed by Data Collection Rules (DCRs). If the DCR is not associated with the target machines or does not include the required Windows Security Event data streams (e.g., `Microsoft-Event` or `SecurityEvent`), the Sentinel connector will stop receiving events. This is the most common root cause because AMA relies entirely on DCRs for configuration, unlike the legacy agent which used workspace settings directly.

Answer

The workspace has a saved KQL function named SecurityEvent

Answer

The machines are assigned an Azure Policy initiative for tags

Answer

The analytics rule is configured as near-real-time

Question 8

A security operations team uses Microsoft Sentinel. They have a scheduled analytics rule that generates an incident when a user signs in from an unusual location. They want to automatically assign the incident to the 'Security Engineering' team and set its severity to 'High' when it is created. Which feature should they use?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to centrally manage the automated handling of incidents, including assigning them to a specific team and setting their severity. When a scheduled analytics rule generates an incident, an automation rule can trigger on incident creation to perform these actions without requiring a playbook or manual intervention.

Answer

Playbooks

Answer

Incident settings in analytics rule

Answer

Workbooks

Question 9

A Sentinel analyst needs to preserve investigation notes, related entities, and ownership while escalating a case to another analyst. Which object should be updated?

Accepted Answer

The Sentinel incident. The Sentinel incident object is the correct entity to update because it serves as the central container for investigation notes, related entities, and ownership assignments during case escalation. Updating the incident preserves the full investigation context—including comments, tags, and assigned owner—ensuring seamless handoff between analysts without data loss.

Answer

A watchlist item

Answer

A workbook parameter

Answer

A data connector

Question 10

A Sentinel rule using a threat intelligence table fires on stale indicators that expired last week. What should be added to the query?

Accepted Answer

A filter for active indicators whose expiration time is in the future. The rule fires on stale indicators because the query lacks a filter to exclude expired threat intelligence entries. Adding a filter for active indicators whose expiration time is in the future ensures that only current, valid indicators trigger the rule, preventing false positives from outdated data.

Answer

A union with Usage

Answer

A sort by Description

Answer

A project-away of ConfidenceScore