CCNA Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Questions

Option B is correct because enabling Defender for Cloud at the subscription level with the SQL servers on machines plan (or Azure SQL databases plan) will automatically enable ATP for all supported resources, including future ones. Option A is wrong because enabling per database is not scalable. Option C is wrong because Azure Policy can be used but is not the most efficient direct method.

Option D is wrong because Microsoft Sentinel is not for enabling ATP.

Option A is correct because enabling the Defender CSPM plan provides basic CSPM and allows enabling specific plans per subscription. Option B is wrong because enabling all plans on Subscription A is not cost-effective for Dev. Option C is wrong because using only free tier does not meet the vulnerability assessment requirement.

Option D is wrong because disabling Defender for Cloud on Dev is not allowed; they need basic CSPM.

Options A and D are correct. The dashboard shows compliance against standards and allows manual evidence upload. Option B is wrong because remediation is done via policy.

Option C is wrong because continuous export is a separate setting. Option E is wrong because the dashboard doesn't directly integrate with external tools.

Option C is correct because 'join' allows combining two event streams on a common key (e.g., user ID) and time window. Option A is wrong because 'union' combines rows, not conditionally. Option B is wrong because 'summarize' aggregates.

Option D is wrong because 'where' filters a single table.

Option C is correct because the Microsoft Entra ID connector in Sentinel specifically ingests audit logs and sign-in logs. Option A is wrong because the Azure Activity connector ingests Azure resource logs, not Entra ID logs. Option B is wrong because the Office 365 connector ingests Exchange and SharePoint logs.

Option D is wrong because the Microsoft Defender XDR connector ingests security alerts from Defender products.

Options A and D are correct. CSPM includes attack path analysis and security governance. Option B is wrong because vulnerability assessment is part of workload protection.

Option C is wrong because JIT access is a workload protection feature. Option E is wrong because UEBA is part of Microsoft Sentinel or Defender for Identity.

Options A, C, and D are correct. Option A is correct because TI indicators must be ingested into Sentinel's TI. Option C is correct because analytics rules can be configured to match TI.

Option D is correct because the TI data connector is used for ingestion. Option B is wrong because watchlists are for reference data, not TI. Option E is wrong because Fusion rules are for correlation, not TI matching.

Option C is correct because the policy audits if Azure Disk Encryption is not enabled on VMs without encryption settings. The condition checks if encryptionSettings does not exist, and then expects the AzureDiskEncryption extension. If the extension is missing, the VM is non-compliant.

Option A is wrong because the policy does not check for Windows patch status. Option B is wrong because the policy does not check for encryption at host. Option D is wrong because the policy is about disk encryption, not backup.

Option A is correct because Microsoft Defender for Containers provides threat detection for AKS clusters, including privilege escalation alerts. Option B is wrong because Azure Policy for AKS enforces security configurations but does not generate alerts. Option C is wrong because Microsoft Sentinel is a separate SIEM that can ingest logs but is not the primary alerting mechanism within Defender for Cloud.

Option D is wrong because Azure Security Center, now Defender for Cloud, includes container protections.

Option A is correct because continuous export allows streaming alerts to Event Hubs for integration with SIEMs. Option B is wrong because diagnostic settings are for logs, not alerts. Option C is wrong because playbooks are for response, not export.

Option D is wrong because Azure Policy is for governance.

Option C is correct because Sentinel requires the Log Analytics workspace to be on a Pay-as-you-go (PerGB2018) pricing tier, but it also requires the workspace to be in a supported region. If the region is not supported, Sentinel cannot be enabled. Option A is wrong because the retention is set to 365 days, which is fine.

Option B is wrong because the PerGB2018 tier is correct. Option D is wrong because resource group location does not affect Sentinel enablement.

Option B is correct because regulatory compliance standards such as Azure CIS 1.4.0 can be applied across multicloud resources in Defender for Cloud. Option A is wrong because AWS Security Hub is a separate service, not integrated natively. Option C is wrong because Azure Policy is for Azure-only.

Option D is wrong because Microsoft Sentinel is for SIEM, not compliance standards.

Option B is correct because the query filters sign-in attempts from disabled accounts (ResultType 50057) in the last hour, but it only excludes two specific IP addresses. This means all other IP addresses (including legitimate ones) will trigger incidents, leading to many false positives. Option A is wrong because the query runs every hour, not too frequently.

Option C is wrong because the query is valid. Option D is wrong because the query already filters by time.

Option A is correct because if the subscription is not using the Defender Cloud Security Posture Management (CSPM) plan, some recommendations may be missing. Option B is wrong because diagnostic logs are not disabled by default in the subscription. Option C is wrong because the recommendation is not based on Log Analytics.

Option D is wrong because Key Vault diagnostics are a standard recommendation.

Option B is correct because the query filters for risky sign-ins from countries other than the US, and then counts them per user; limiting to >3 detects users with multiple risky sign-ins from non-US countries. Option A is wrong because it doesn't compare to previous behavior. Option C is wrong because it doesn't compare to other users.

Option D is wrong because it doesn't look for impossible travel.

Option A is correct because the query summarizes the count of alerts by AlertName and AlertSeverity and returns the top 10 by count descending. Option B is wrong because the query does not filter by severity. Option C is wrong because it returns top 10, not all.

Option D is wrong because it does not filter by time beyond the initial 7 days.

Option A is correct because the best approach is to create a fusion rule, which uses machine learning to correlate multiple signals like unfamiliar sign-in and Azure activity. Option B is wrong because scheduled query rules require writing KQL and can correlate but fusion is simpler for this scenario. Option C is wrong because NRT rules are for near-real-time single events.

Option D is wrong because anomaly rules detect outliers but not multi-step correlation.

Option B is correct because the query runs every 5 minutes looking at 15 minutes of data, so there is overlap and data should be captured; however, the rule may be misconfigured with an incorrect query or entities. Option A is wrong because the query frequency and data lookback are compatible. Option C is wrong because the rule is enabled.

Option D is wrong because rule severity does not affect alert generation.

Option C is correct because the query filters events where the hour is not between 9 and 17 (24-hour format). Option A is wrong because it would trigger for any time. Option B is wrong because it filters for business hours only.

Option D is wrong because it uses a different event ID.

Option B is correct because assigning a policy initiative at the management group level ensures all subscriptions under that group inherit the policy, including new ones. Option A is wrong because assigning at the subscription level would require manual assignment for each subscription and won't automatically apply to new ones. Option C is wrong because Azure Blueprints are being deprecated and are not the recommended approach.

Option D is wrong because Azure Policy does not support inheritance from a resource group to a subscription.

Option D is correct because it sums the response body size in bytes and converts to GB, then filters above 1 GB. Option A is wrong because it uses average instead of sum. Option B is wrong because it uses count instead of sum.

Option C is wrong because it only checks if any single operation exceeds 1 GB.

Options A, B, and D are correct. Option A is correct because Just-in-time VM access is a feature. Option B is correct because file integrity monitoring is included.

Option D is correct because adaptive application controls are part of workload protection. Option C is wrong because DDoS protection is a separate service. Option E is wrong because data loss prevention is part of Microsoft Purview.

Option C is correct because creating a suppression rule in Defender for Cloud allows you to suppress alerts based on specific criteria like IP address or alert title, reducing false positives. Option A is wrong because disabling the alert rule would miss real threats. Option B is wrong because excluding the database from vulnerability assessment would also miss real vulnerabilities.

Option D is wrong because modifying the firewall rules is not related to alert suppression.

Option A is correct because the data connector for Microsoft Defender for Cloud ingests alerts and automatically creates incidents based on the analytics rule. Option B is wrong because a playbook runs after incident creation, not before. Option C is wrong because a workbook is for visualization.

Option D is wrong because a scheduled rule queries logs but doesn't directly connect to Defender alerts.

Option B is correct because Microsoft Defender for Endpoint (now part of Defender XDR) provides real-time protection and integrates with Defender for Cloud. Option A is wrong because AMA is an agent, not a security solution. Option C is wrong because Microsoft Antimalware does not cover fileless malware.

Option D is wrong because Azure Security Center is the same as Defender for Cloud, not an endpoint protection.

Option B is correct because it uses 'let' to define the user deletion time, then joins with ActivityLogs to count resource deletions within 24 hours. Option A is wrong because it does not filter for resource deletion operations. Option C is wrong because it uses 'summarize' incorrectly.

Option D is wrong because it does not handle the time window correctly.

Option D is correct because 'Attack simulation training' in Microsoft 365 Defender allows you to simulate phishing attacks and identify users who are vulnerable. Option A is wrong because 'Conditional Access policies' are for enforcing MFA, not detecting phishing. Option B is wrong because 'Identity Protection' detects risky sign-ins but does not simulate attacks.

Option C is wrong because 'Microsoft Defender for Office 365' includes anti-phishing but not simulation.

The 'union' operator can be used with a workspace expression to combine data from multiple workspaces. Option A is correct. Option B is for joining tables.

Option C is for filtering. Option D is for creating subsets.

Option A is correct because Azure Active Directory logs require two connectors: one for Sign-in logs and one for Audit logs. Option B is wrong because the Office 365 connector does not include Azure AD logs. Option C is wrong because the Azure Activity connector is for Azure subscription management logs.

Option D is wrong because the Security Events connector is for VMs.

Option C is correct because creating an alert suppression rule in Microsoft Sentinel allows analysts to suppress alerts from specific IP ranges without modifying the underlying analytics rule. Option A is wrong because disabling the analytics rule removes detection entirely. Option B is wrong because watchlists are used for correlation, not suppression.

Option D is wrong because automation rules can run actions but not suppress alerts directly; suppression is a built-in feature of analytics rules.

Option C is correct because Defender for Cloud's Vulnerability Assessment solution can be enforced via policy to auto-install on VMs. Option A is wrong because Azure Policy can enforce compliance but not automatically install. Option B is wrong because Azure Update Management is for OS updates, not vulnerability assessment.

Option D is wrong because Azure Automation can run scripts but is not the recommended Defender solution.

Option A is correct because Azure Security Benchmark includes a policy to audit storage accounts for CMK encryption. Option B is wrong because ISO 27001 doesn't specifically cover CMK. Option C is wrong because NIST SP 800-53 doesn't have a direct CMK audit policy.

Option D is wrong because CIS Microsoft Azure Foundations Benchmark has a different scope.

Option D is correct because UEBA provides investigation insights and entity pages that show user activities and related entities. Option A is wrong because Workbooks are for custom dashboards. Option B is wrong because Hunting queries are for proactive searches.

Option C is wrong because Analytics rules are for alert creation.

Sentinel's investigation graph allows pivoting from a user entity to see related alerts, events, and activities. Option A is wrong because workbooks are custom dashboards, not entity-specific. Option B is wrong because analytics rules are for detection.

Option D is wrong because the entity page is a static view, not a graph.

Option D is correct because Sentinel automation rules can trigger a playbook that runs a script to add a network security group (NSG) rule to deny the IP. Option A (manual NSG rule) is not automatic. Option B (Azure Policy) is not designed for real-time blocking.

Option C (JIT access) controls access, not blocking specific IPs.

Option A and D are correct. Automation rules can automatically assign incidents to analysts (A) and trigger playbooks based on conditions (D). Option B is wrong because automation rules do not create analytics rules.

Option C is wrong because automation rules do not aggregate incidents; they can suppress or create tasks. Option E is wrong because automation rules do not query external threat intelligence feeds.

Option A is correct because it groups failed sign-ins by IP address, counts them within a 5-minute time window, and filters for counts greater than 10. Option B is wrong because it uses time-generated, which is not a standard column; the correct column is TimeGenerated. Option C is wrong because it incorrectly uses 'make-series' which is for time series analysis, not simple aggregation.

Option D is wrong because it filters only successful sign-ins.

Option B is correct because using a single workspace in the US centralizes data and minimizes costs, as data from other regions can be collected via diagnostic settings without egress fees for Azure-to-Azure traffic within the same continent. Option A is wrong because multiple workspaces increase egress costs and complexity. Option C is wrong because it does not reduce egress costs.

Option D is wrong because using multiple workspaces with cross-workspace queries increases egress costs.

Even with the subscription-level plan enabled, you need to install the 'Defender profile' on the AKS cluster. Option D is correct. Option A is incorrect because the cluster is not protected yet.

Option B is incorrect because enabling Azure Policy for Kubernetes is a separate step. Option C is incorrect because the agents are deployed via the Defender profile.

Option D is correct because the default initiative assigned to all subscriptions in Defender for Cloud is the Microsoft Cloud Security Benchmark (MCSB). Option A is wrong because the CIS benchmark is a different standard and not the default. Option B is wrong because standards are assigned at the subscription level, not management group.

Option C is wrong because regulatory compliance is a separate feature and does not replace the default benchmark.

Option B is correct because vulnerability assessment (VA) solutions, like the integrated Qualys or Microsoft Defender Vulnerability Management, scan for known vulnerabilities and generate alerts. Option A is wrong because adaptive application controls are for whitelisting applications, not vulnerability detection. Option C is wrong because just-in-time (JIT) VM access is for managing RDP/SSH access.

Option D is wrong because file integrity monitoring (FIM) monitors file changes, not vulnerabilities.

Options A, C, and E are correct. Option A is correct because email notifications for critical alerts can be configured in Defender for Cloud. Option C is correct because a continuous export rule can send alerts to Event Hubs, which can trigger a Logic App.

Option E is correct because a Logic App can integrate with ServiceNow. Option B is wrong because the Log Analytics agent is not needed for alerts. Option D is wrong because a playbook in Sentinel is not required; the integration can be done via Logic Apps directly.

Option D is correct because Microsoft Defender for Cloud for Azure SQL databases includes threat detection that alerts on anomalous access patterns, including suspicious locations. Option A is wrong because Advanced Threat Protection is the feature name, but it is enabled under Microsoft Defender for Cloud. Option B is wrong because Azure SQL Database auditing logs activity but does not generate alerts.

Option C is wrong because Azure Firewall logs network traffic but does not generate SQL-specific alerts.

Option A is correct because to comply with data residency, you need separate Sentinel workspaces per region. Option B is wrong because Sentinel does not support data-level routing to different storage locations within a single workspace. Option C is wrong because using a single workspace with diagnostic settings does not separate storage.

Option D is wrong because Azure Purview is for data governance, not storage.

Option A and Option D are correct because Microsoft Entra ID logs are ingested via diagnostic settings, and the data connector in Sentinel is used to establish the connection. Option B is wrong because a Log Analytics workspace is required, not a separate one. Option C is wrong because the Log Analytics agent is for VMs, not for Entra ID logs.

Option E is wrong because there is a specific connector for Entra ID.

Option B is correct because the query groups by UserPrincipalName, IPAddress, and hour; if the same user signs in from the same IP within the same hour, it's not anomalous. Option A is wrong because the rule is enabled. Option C is wrong because no aggregation threshold is set.

Option D is wrong because the data connector might be slow but would still generate some alerts.

Option C is correct because the existence condition only references the storage account encryption type; it does not include a condition for Cosmos DB. Option A is wrong because Cosmos DB does support CMK. Option B is wrong because the policy mode 'All' evaluates resource types not explicitly excluded.

Option D is wrong because the policy already includes both resource types in the if condition.

Option B is correct because the policy audits storage accounts that do not have keySource = Microsoft.Keyvault. Since the storage account uses Microsoft-managed keys (keySource = Microsoft.Storage), it is non-compliant. Option A is wrong because it is non-compliant.

Option C is wrong because the policy is an audit effect, not deny. Option D is wrong because the policy is assigned and evaluated.

Option A is correct because the regulatory compliance dashboard by default only assesses resources that are in scope for the selected standard. If a subscription or resource group is not included in the scope, controls will show as 'N/A'. Option B is wrong because the dashboard only assesses resources, not manual claims.

Option C is wrong because the dashboard uses built-in assessments; it does not require custom assessments. Option D is wrong because the dashboard is available even without a compliance manager license.

Options A and D are correct. Option A is correct because the Defender for Containers plan must be enabled at the subscription level. Option D is correct because the Kubernetes audit logs must be enabled and sent to a Log Analytics workspace.

Option B is wrong because Azure Policy is not required for the plan. Option C is wrong because the plan does not require a specific agent; it uses audit logs. Option E is wrong because Azure Arc is for non-Azure clusters.

Option A is correct because the Advanced Threat Protection (ATP) must be enabled at the server level for Defender for Cloud to monitor it. Option B (auditing) is not required for ATP. Option C (service endpoint) does not block ATP.

Option D (firewall rules) irrelevant.

Option C is correct because security policies with severity-based suppression rules allow filtering out low-severity alerts while keeping high-severity ones. Option A is wrong because disabling all low-severity alerts would miss potentially important indicators. Option B is wrong because manual suppression is not scalable.

Option D is wrong because Microsoft Entra Permissions Management is for identity permissions, not alert suppression.

Azure Policy with DeployIfNotExists effect can automatically deploy the Log Analytics agent to all VMs in a subscription. Option A is wrong because manual installation is not scalable. Option C is wrong because Azure Automation DSC is for configuration management, not agent deployment.

Option D is wrong because the Azure portal VM blade is manual.

Option C is correct because Microsoft Graph API allows actions like deleting emails from mailboxes, and Sentinel playbooks can call Graph API. Option A is wrong because Microsoft 365 Defender API is for threat data, not mailbox actions. Option B is wrong because Exchange Online PowerShell is not directly callable from Sentinel playbooks.

Option D is wrong because Microsoft Power Automate is the platform, not the integration.

Sentinel ingestion of Entra ID logs requires diagnostic settings to be configured on the Entra ID tenant. By default, diagnostic settings are not enabled for external guest user sign-ins. Option C is correct.

Option A is not a requirement. Option B is incorrect because guest user sign-ins are logged but need diagnostic settings. Option D is incorrect because the connector does not filter by user type.

Option A and Option B are correct because Azure Activity logs provide management plane activities, and Windows Security Events provide OS-level events from VMs. Option C is wrong because Azure DNS logs are not a standard Sentinel connector. Option D is wrong because Azure Firewall logs are for specific firewall traffic, not broad network traffic.

Option E is wrong because Office 365 logs are for Microsoft 365, not Azure VMs.

Option A (Playbooks) are automated workflows that can be triggered from analytics rules. Option B (Automation rules) centrally manage automated responses. Option C (Workbooks) are visualizations, not automated responses.

Option D (Watchlists) are data sources. Option E (Hunting queries) are proactive searches, not automated responses.

Option A is correct because the policy only deploys if no security contact exists with a non-empty email. Since a contact exists, the policy will not modify it. Option B is wrong because the policy uses deployIfNotExists with existence check.

Option C is wrong because the policy won't fail. Option D is wrong because the policy is not evaluated as non-compliant.

Option B and Option C are correct because Microsoft Defender for Cloud for Storage includes threat detection that alerts on suspicious access patterns, and enabling logging to the Log Analytics workspace provides detailed data for analysis. Option A is wrong because Azure Storage Firewall restricts access but does not generate alerts. Option D is wrong because Azure Storage Encryption protects data at rest, not access monitoring.

Option E is wrong because Azure Defender is the old name; the correct name is Microsoft Defender for Cloud.

Option A is correct because it uses the custom function to filter, sums connections per VM, and uses threshold of 10. Option B is wrong because it uses a simple threshold without aggregation. Option C is wrong because it looks for 10 different IPs, not connections.

Option D is wrong because it doesn't use the custom function and instead uses a list, which is less maintainable.

Option D is correct because assigning Azure Policy at the management group scope with a 'DeployIfNotExists' or 'AuditIfNotExists' effect can enforce governance on deployed resources only, and using exemptions for non-deployed resources. Option A is wrong because disabling recommendations affects all resources. Option B is wrong because the secure score automatically considers only assessed resources, but the issue might be with planned resources being assessed incorrectly.

Option C is wrong because creating custom initiatives does not filter out non-deployed resources automatically.

Option C is correct because the regulatory compliance dashboard in Defender for Cloud allows you to add custom initiatives and standards, including custom assessments. Option A is wrong because Azure Blueprints are deprecated and not the correct tool. Option B is wrong because Azure Policy alone does not integrate with the compliance dashboard.

Option D is wrong because Microsoft Purview compliance portal is for data governance, not cloud security compliance assessment.

Option A is correct because 'az policy definition show' retrieves details of a policy definition by ID. Option B is wrong because 'az policy assignment list' lists assignments, not definitions. Option C is wrong because 'az policy set-definition show' shows initiative definitions, not individual definitions.

Option D is wrong because 'az policy definition list' lists all definitions, not a specific one.

Option D is correct because the Windows Security Events connector in Sentinel requires specific event IDs to be collected; if the data collection rule or agent configuration does not include the required event IDs, the events won't be sent. Option A is wrong because the Log Analytics workspace key or certificate issue would affect all data, not just security events. Option B is wrong because if the agent is connected, network connectivity is fine.

Option C is wrong because the Microsoft Sentinel solution is installed at the workspace level, not per VM.

Options A and C are correct. Option A is correct because the data connector for Microsoft Defender XDR ingests alerts. Option C is correct because enabling automatic incident creation in the connector creates incidents.

Option B is wrong because playbooks are for automation, not integration. Option D is wrong because cross-tenant integration requires Lighthouse. Option E is wrong because custom logs do not integrate automatically.

Options B, C, and D are correct. You need appropriate permissions (B), a valid license for Microsoft 365 Defender (C), and the data connector must be enabled in Sentinel (D). Option A is wrong because you don't need an Azure Sentinel workspace in a specific region; any region works.

Option E is wrong because you don't need to install agents on endpoints; Defender XDR collects data automatically.

Option D is correct because regulatory compliance standards in Defender for Cloud map recommendations to specific frameworks. Option A is wrong because secure score is for overall posture. Option B is wrong because Azure Policy is the underlying engine.

Option C is wrong because inventory lists resources.

Option B is correct because Azure Logic Apps is the engine that runs playbooks. Option A is wrong because KQL is a query language, not an automation tool. Option C is wrong because Azure Functions can be used within logic apps but are not the primary playbook runner.

Option D is wrong because Azure Automation runbooks are not directly integrated with Sentinel playbooks.

Option C is correct because the PCI DSS initiative includes policies that must be assigned and evaluated; if not assigned, controls show 'Not started'. Option A is wrong because the dashboard includes custom initiatives. Option B is wrong because pricing tier doesn't affect policy assignment.

Option D is wrong because Azure Policy assigns initiatives, not Defender for Cloud directly.